Mike M. – Page 27

Nvidia announces end of GPU driver updates for GeForce 10-series, Windows 10

gaming, GeForce, geforce gtx, geforce gtx 1060, NVIDIA, Tech / Mike M. / July 31, 2025

The Maxwell, Pascal, and Volta GPUs won’t be totally abandoned after 2025; Nvidia says it will release quarterly security updates for these cards through October 2028. These updates won’t optimize performance or fix bugs in any new games, but if you still have an older or hand-me-down PC using one of these cards to play Minecraft or Roblox, you won’t be leaving yourself open to GPU-related security exploits.

Nvidia has dropped hints that the end of support for these older GPUs was coming. The company announced back in January that CUDA support for the Maxwell, Pascal, and Volta architectures was considered “feature complete” and was being frozen. This is the first time since 2021 that Nvidia has dropped support for older GPUs.

As for Windows 10, Microsoft has been pushing users toward Windows 11 for years, including by using full-screen ads encouraging people to buy new Copilot+ PCs, but the older operating system still has a sizable user base. According to the Steam Hardware Survey, Windows 10 is in decline, but it still powers over a third of the PCs in the survey as of June 2025, compared to a little over 60 percent for Windows 11.

Nvidia announces end of GPU driver updates for GeForce 10-series, Windows 10 Read More »

In search of riches, hackers plant 4G-enabled Raspberry Pi in bank network

ATM, banks, Biz & IT, hackers, Raspberry Pi, Security / Mike M. / July 31, 2025

“One of the most unusual elements of this case was the attacker’s use of physical access to install a Raspberry Pi device,” Group-IB Senior Digital Forensics and Incident Response Specialist Nam Le Phuong wrote. “This device was connected directly to the same network switch as the ATM, effectively placing it inside the bank’s internal network. The Raspberry Pi was equipped with a 4G modem, allowing remote access over mobile data.”

To maintain persistence, UNC2891 also compromised a mail server because it had constant Internet connectivity. The Raspberry Pi and the mail server backdoor would then communicate by using the bank’s monitoring server as an intermediary. The monitoring server was chosen because it had access to almost every server within the data center.

The Network Monitoring Server as an intermediary between the Raspberry Pi and the Mail Server. Credit: Group-IB

As Group-IB was initially investigating the bank’s network, researchers noticed some unusual behaviors on the monitoring server, including an outbound beaconing signal every 10 minutes and repeated connection attempts to an unknown device. The researchers then used a forensic tool to analyze the communications. The tool identified the endpoints as a Raspberry Pi and the mail server but was unable to identify the process names responsible for the beaconing.

The forensic triage tool is unable to collect the relevant process name or ID associated with the socket. Credit: Group-IB

The researchers then captured the system memory as the beacons were sent. The review identified the process as lightdm, a process associated with an open source LightDM display manager. The process appeared to be legitimate, but the researchers found it suspicious because the LightDM binary was installed in an unusual location. After further investigation, the researchers discovered that the processes of the custom backdoor had been deliberately disguised in an attempt to throw researchers off the scent.

Phuong explained:

The backdoor process is deliberately obfuscated by the threat actor through the use of process masquerading. Specifically, the binary is named “lightdm”, mimicking the legitimate LightDM display manager commonly found on Linux systems. To enhance the deception, the process is executed with command-line arguments resembling legitimate parameters – for example,

lightdm –session child 11 19 — in an effort to evade detection and mislead forensic analysts during post-compromise investigations.

These backdoors were actively establishing connections to both the Raspberry Pi and the internal Mail Server.

As noted earlier, the processes were disguised using the Linux bind mount. Following that discovery, Group-IB added the technique to the MITRE ATT&CK framework as “T1564.013 – Hide Artifacts: Bind Mounts.”

Group-IB didn’t say where the compromised switching equipment was located or how attackers managed to plant the Raspberry Pi. The attack was detected and shut down before UNC2891 was able to achieve its final goal of infecting the ATM switching network with the CakeTap backdoor.

In search of riches, hackers plant 4G-enabled Raspberry Pi in bank network Read More »

Not (just) seeing red: Virtual Boy emulator adds full color support

Color, Emulation, gaming, Nintendo, RED, retro, virtual boy / Mike M. / July 30, 2025

With Red Viper’s built-in color support, though, anyone with a 3DS modded for homebrew software can now easily add a bit of color to the Virtual Boy library. And running the emulator on the 3DS means you don’t even have to give up the Virtual Boy’s stereoscopic graphics to do so; Red Viper works with the filtered LCD screen on the 3DS to emulate the visual depth built into Virtual Boy games.

More than just Wario Land

Red Viper currently doesn’t have any “default” palettes to choose from, meaning it can take some manual fiddling to get multicolor games to look halfway decent (you can save your palettes on a per-game basis). Once you do, though, it’s impressive just how much color adds to games that were never designed to be seen in more than a few shades of red.

The higher contrast between the road and the racers helps make homebrew Virtual Boy Mario Kart much more playable. Kyle Orland / Red Viper

We’ve found that high contrast yellow or green can really help sprites stand out from the jet black backgrounds that dominate most Virtual Boy releases. Accent colors in the blue or purple range, meanwhile, can help set off background elements and make them easier to distinguish from the foreground gameplay. Those color enhancements can be more than just aesthetic, too; in a game like Red Viper, distinct colors make it much easier to distinguish enemies from stationary obstacles in the game’s awkward wire-framed 3D.

After you’re done colorizing all the Virtual Boy ROMs you’ve dumped off of your own legitimately purchased cartridges (cough), it’s worth dipping a toe in the impressive collection of homebrew Virtual Boy games created by homebrew coders over the years. That includes impressive ports of games like Street Fighter II and Mario Kart and original efforts like a cartoony fish-eat-fish simulator or a hamburger based shoot-’em-up .

Whether you’re a Virtual Boy aficionado or new to the world, the newly colorized Red Viper is the perfect excuse to visit this odd cul-de-sac in Nintendo’s hardware history. Now if we could just convince Nintendo to release an official miniaturized set of Virtual Boy VR goggles à la the NES Classic.

Not (just) seeing red: Virtual Boy emulator adds full color support Read More »

EPA plans to ignore science, stop regulating greenhouse gases

clean air act, CO2, EPA, greenhouse gases, Policy, Science, syndication / Mike M. / July 30, 2025

It derives from a 2007 Supreme Court ruling that named greenhouse gases as “air pollutants,” giving the EPA the mandate to regulate them under the Clean Air Act.

Critics of the rule say that the Clean Air Act was fashioned to manage localized emissions, not those responsible for global climate change.

A rollback would automatically weaken the greenhouse gas emissions standards for cars and heavy-duty vehicles. Manufacturers such as Daimler and Volvo Cars have previously opposed the EPA’s efforts to tighten emission standards, while organized labour groups such as the American Trucking Association said they “put the trucking industry on a path to economic ruin.”

However, Katherine García, director of Sierra Club’s Clean Transportation for All Campaign, said that the ruling would be “disastrous for curbing toxic truck pollution, especially in frontline communities disproportionately burdened by diesel exhaust.”

Energy experts said the move could also stall progress on developing clean energy sources such as nuclear power.

“Bipartisan support for nuclear largely rests on the fact that it doesn’t have carbon emissions,” said Ken Irvin, a partner in Sidley Austin’s global energy and infrastructure practice. “If carbon stops being considered to endanger human welfare, that might take away momentum from nuclear.”

The proposed rule from the EPA will go through a public comment period and inter-agency review. It is likely to face legal challenges from environmental activists.

EPA plans to ignore science, stop regulating greenhouse gases Read More »

Spilling the Tea

Spilling / Mike M. / July 30, 2025

The Tea app is or at least was on fire, rapidly gaining lots of users. This opens up two discussions, one on the game theory and dynamics of Tea, one on its abysmal security.

It’s a little too on the nose that a hot new app that purports to exist so that women can anonymously seek out and spill the tea on men, which then puts user information into an unprotected dropbox thus spilling the tea on the identities of many of its users.

In the circles I follow this predictably led to discussions about how badly the app was coded and incorrect speculation that this was linked to vibe coding, whereas the dumb mistakes involved were in this case fully human.

There was also some discussion of the game theory of Tea, which I found considerably more interesting and fun, and which will take up the bulk of the post.

Tea offers a variety of services, while attempting to gate itself to only allow in women (or at least, not cis men), although working around this is clearly not hard if a man wanted to do that, and to only allow discussion and targeting of men.

Some of this is services like phone number lookup, social media and dating app search, reverse image internet search and criminal background checks. The photo you give is checked against catfishing databases. Those parts seem good.

There’s also generic dating advice and forums within the app, sure, fine.

The central feature is that you list a guy with a first name, location and picture – which given AI is pretty much enough for anyone these days to figure out who it is even if they don’t recognize them – and ask ‘are we dating the same guy?’ and about past experiences, divided into green and red flag posts. You can also set up alerts on guys in case there is any new tea.

What’s weird about ‘are we dating the same guy?’ is that the network effects required for that to work are very large, since you’re realistically counting on one or at most a handful of other people in the same position asking the same question. And if you do get the network big enough, search costs should then be very high, since reverse image search on a Facebook group is highly unreliable. It’s kind of amazing that the human recognition strategies people mostly use here worked at all in populated areas without proper systematization.

Tea provides much better search tools including notifications, which gives you a fighting chance, and one unified pool. But even with 4.6 million women, the chances of any given other woman being on it at all are not so high, and they then have to be an active user or have already left the note.

When I asked Claude about this it suggested the real win was finding Instagram or LinkedIn profiles, and that indeed makes a lot more sense. That’s good information, and it’s also voluntarily posted so it’s fair game.

Using a Hall of Shame seems even more inefficient. What, you are supposed to learn who the bad men are one by one? None of this seems like an effective use of time, even if you don’t have any ethical or accuracy concerns. This can’t be The Way, not outside of a small town or community.

The core good idea of the mechanics behind Tea is to give men Skin In The Game. The ideal amount of reputation that gets carried between interactions is not zero. The twin problems are that the ideal amount has an upper bound, and also that those providing that reputation also need Skin In The Game, gossip only works if there are consequences for spreading false gossip, and here those consequences seem absent.

What happens if someone lies or otherwise abuses the system? Everything is supposedly anonymous and works on negative selection. The app is very obviously ripe for abuse, all but made for attempts to sabotage or hurt people, using false or true information. A lot of what follows will be gaming that out.

The moderation team has a theoretical zero tolerance policy for defamation and harassment when evidence is provided, but such things are usually impossible to prove and the bar for actually violating the rules is high. Even if a violation is found and proof is possible, and the mod team would be willing to do something if proof was provided, if the target doesn’t know about the claims how can they respond?

Even then there don’t seem likely to be any consequences to the original poster.

Shall we now solve for the equilibrium, assuming the app isn’t sued into oblivion?

While tea is small and relatively unknown, the main worries (assuming the tools are accurate) are things like vindictive exes. There’s usually a reason when that happens, but there are going to be some rather nasty false positives.

As tea gets larger, it starts to change incentives in both good and bad ways, there are good reasons to start to try and manage, manipulate or fool the system, and things start to get weird. Threats and promises of actions within tea will loom in the air on every date and in every relationship. Indeed every interaction, essentially any woman (and realistically also any man) could threaten to spill tea, truthfully or otherwise, at any time.

Men will soon start asking for green flag posts, both accurate ones from exes and very much otherwise, services to do this will spring up, dummy accounts will be used where men are praising themselves.

Men will absolutely at minimum need to know what is being said, set up alerts on themselves, run all the background checks to see what will come up, and work to change the answer to that if it’s not what they want it to be. Presumably there will be plenty happy to sell you this service for very little, since half the population can provide such a service at very low marginal cost.

Quickly word of the rules of how to sculpt your background checks will spread.

And so on. It presumably will get very messy very quickly. The system simultaneously relies on sufficient network effects to make things like ‘are we dating the same guy?’ work, and devolves into chaos if usage gets too high.

One potential counterforce is that it would be pretty bad tea to have a reputation of trying to influence your tea. I doubt that ends up being enough.

At lunch, I told a woman that Tea exists and explained what it was.

Her: That should be illegal.

Her (10 seconds later): I need to go there and warn people about [an ex].

Her (a little later than that, paraphrased a bit): Actually no. He’s crazy, who knows what he might do if he found out.

Her (after I told her about the data breach): Oh I suppose I can’t use it then.

There is certainly an argument in many cases including this one for ‘[X] should be illegal but if it’s going to be legal then I should do it,’ and she clarified that her opposition was in particular to the image searches, although she quickly pointed out many other downsides as well.

The instinct is that all of this is bad for men.

That seems highly plausible but not automatic or obvious.

Many aspects of reputation and competition are positional goods and have zero-sum aspects in many of the places that Tea is threatening to cause trouble. Creating safer and better informed interactions and matches can be better for everything.

More generally, punishing defectors is by default very good for everyone, even if you are sad that it is now harder for you to defect. You’d rather be a good actor in the space, but previously in many ways ‘bad men drove out good’ placing pressure on you to not act well. This also that all this allows women to feel safe and let their guard down, and so on. A true ‘safety app’ is a good thing.

It could also motivate women to date more and use the apps more. It’s a better product when it is safer, far better, so you consume more of it. If no one has yet hooked the dating apps up automatically to tea so that you can get the tea as you swipe, well, get on that. Thus it can also act as a large improvement on matching. No, you don’t match directly on tea, but it provides a lot of information.

Another possible advantage is that receptivity to this could provide positive selection. If a woman doesn’t want to date you because of unverified internet comments, that is a red flag, especially for you in particular, in several ways at once. It means they probably weren’t that into you. It means they sought out and were swayed by the information. You plausibly dodged a bullet.

A final advantage is that this might be replacing systems that are less central and less reliable and that had worse enforcement mechanisms, including both groups and also things like whisper networks.

Consider the flip side, an app called No Tea, that men could use to effectively hide their pasts and reputations and information, without making it obvious they were doing this. Very obviously this would make even men net worse off if it went past some point.

As in, even from purely the man’s perspective: The correct amount of tea is not zero.

There are still six groups of ways I could think of that Tea could indeed be bad for men in general at current margins, as opposed to bad for men who deserve it, and it is not a good sign that over the days I wrote this the list kept growing.

Men could in general find large utility in doing things that earn them very bad reputations on tea, and be forced to stop.
1. This is highly unsympathetic, as they mostly involve things like cheating and otherwise treating women badly. I do not think those behaviors in general make men’s lives better, especially as a group.
2. I also find it unlikely that men get large utility in absolute terms from such actions, rather than getting utility in relative terms. If you can get everyone to stop, I think most men win out here near current margins.
Women could be bad at the Law of Conservation of Expected Evidence. As in, perhaps they update strongly negatively on negative information when they find it, but do not update appropriately positively when such information is not found, and do not adjust their calibration over time.
1. This is reasonably marketed as a ‘safety app.’ If you are checked and come back clean, that should make you a lot safer and more trustworthy. That’s big.
  
  The existence of the app also updates expectations, if the men know that the app exists and that they could end up on it.
2. In general, variance in response is your friend so long as the downside risk stops at a hard pass. You only need one yes, also you get favorable selection.
3. Also, this could change the effective numerical dynamics. If a bunch of men become off limits due to tea, especially if that group often involves men who date multiple women at once, the numbers game can change a lot.
Men could be forced to invest resources into reputation management in wasteful or harmful ways, and spend a lot of time being paranoid. This may favor men willing to game the system, or who can credibly threaten retaliation.
1. This seems highly plausible, hopefully this is limited in scope.
2. The threat of retaliation issue seems like a potentially big deal. The information will frequently get back to the target, and in many cases the source of the information will be obvious, especially if the information is true.
3. Ideally the better way to fix your reputation is to deserve a better one, but even then there would still be a lot of people who don’t know this, or who are in a different situation.
Men could face threats, blackmail and power dynamic problems. Even if unstated, the threat to use tea, including dishonestly, looms in the air.
1. This also seems like a big problem.
2. Imagine dating, except you have to maintain a 5-star rating.
3. In general, you want to seek positive selection, and tea risks making you worry a lot about negative selection, well beyond the places you actually need to worry about that (e.g. when you might hurt someone for real).
4. The flip side is this could force you to employ positive selection? As in, there are many reasons why avoiding those who create such risks is a good idea.
Men might face worse tea prospects the more they date, if the downside risk of each encounter greatly exceeds the upside. Green flags are rare and not that valuable, red flags can sink you. So confidence and boldness decline, the amount of dating and risk taking and especially approaching goes down.
1. We already have this problem pretty bad based on phantom fears. That could mean it gets way worse, or that it can’t get much worse. Hard to say.
2. If you design Tea or users create norms such that this reverses, and more dating gets you a better Tea reputation so long as you deserve one, then that could be a huge win.
3. It would be a push to put yourself out there in a positive way, and gamify things providing a sense of progress even if someone ultimately wasn’t a match, including making it easier to notice this quickly and move on, essentially ‘forcing you into a good move.’
It’s a massive invasion of privacy, puts you at an informational disadvantage, and it could spill over into your non-dating life. The negative information could spread into the non-dating world, where the Law of Conservation of Expected Evidence very much does not apply. Careers and lives could plausibly be ruined.
1. This seems like a pretty big and obvious objection. Privacy is a big deal.
2. What is going to keep employers and HR departments off the app?

MJ: this is straight up demonic. absolutely no one should be allowed to create public profiles about you to crowdsource your deeply personal information and dating history.

People are taking issue with me casually throwing out the word “demonic.” so let me double down. The creators of this app are going to get rich off making many decent people depressed and suicidal.

This isn’t about safety. This isn’t just a background check app. Their own promo material clearly markets this as a way to anonymously share unverified gossip and rumors from scorned exes.

Benjamin Foss: Women shouldn’t be allowed to warn other women about stalkers, predators, and cheaters?

MJ: If you think that’s what this app is primarily going to be used for then I have a bridge to sell you.

Definitely Next Year: “Why can’t I find a nice guy?” Because you listened to his psychopathic ex anonymously make stuff up about him.

My current read is that this would all be good if it somehow had strong mechanisms to catch and punish attempts to misuse the system, especially keeping it from spilling over outside of one’s dating life. The problem is I have a hard time imagining how that will work, and I see a lot of potential for misuse that I think will overwhelm the positive advantages.

Is the core tea mechanic (as opposed to the side functions) good for women? By default more information should be good even if unreliable, so long as you know how to use it, although the time and attention cost and the attitudinal shifts could easily overwhelm that, and this could crowd out superior options.

The actual answer here likely comes down to what this does to male incentives. I am guessing this would, once the app scales, dominate the value of improved information.

If this induces better behavior due to reputational concerns, then it is net good. If it instead mainly induces fear and risk aversion and twists dynamics, then it could be quite bad. This is very much not a Battle of the Sexes or a zero sum game. If the men who don’t richly deserve it lose, probably the women also lose. If those men win, the women probably also win.

What Tea and its precursor groups are actually doing is reducing the Level of Friction in this type of anonymous information sharing and search, attempting to move it down from Level 2 (annoying to get) into Level 1 (minimal frictions) or even Level 0 (a default action).

In particular, this moves the information sharing from one-to-one to one-to-many. Information hits different when anyone can see it, and will hit even more different when AI systems start scraping and investigating.

As with many things, that can be a large difference in kind. This can break systems and also the legal systems built around interactions.

CNN has an article looking into the legal implications of Tea, noting that the legal bar for taking action against either the app or a user of the app is very high.

So yes, of course the Tea app whose hosts have literally held sessions entitled ‘spilling the tea on tea’ got hacked to spill its own Tea, as in the selfies and IDs of its users, which includes their addresses.

Tea claimed that it only held your ID temporarily to verify you are a woman, and that the breached data was being stored ‘in compliance with law enforcement requirements related to cyber-bullying.’

Well, actually…

Howie Dewin: It turns out that the “Tea” app DOXXES all its users by uploading both ID and face verification photos, completely uncensored, to a public bucket on their server.

The genius Brazilians over at “Tea” must have wanted to play soccer in the favela instead of setting their firebase bucket to private.

Global Index: Leaked their addresses too 😳

I mean, that’s not even getting hacked. That’s ridiculous. It’s more like ‘someone discovered they were storing things in a public dropbox.’

It would indeed be nice to have a general (blockchain blockchain blockchain? Apple and Google? Anyone?) solution to solving the problem of proving aspects of your identity without revealing your identity, as in one that people actually use in practice for things like this.

Neeraj Agrawal: If there was ever an example for why need an open and privacy preserving digital ID standard.

You should be able to prove your ID card says something, like your age or in this case your gender, without revealing your address.

Kyle DH: There’s about 4 standards that can do this, but no one has their hands on these digital forms so they don’t get requested and there’s tradeoffs when we make this broadly available on the Web.

Tea eventually released an official statement about what happened.

This is, as Lulu Meservey points out, a terrible response clearly focused on legal risk. No apology, responsibility is dodged, obvious lying, far too slow.

Rob Freund: Soooo that was a lie

Eliezer Yudkowsky: People shouting “Sue them!”, but Tea doesn’t have that much money.

The liberaltarian solution: requiring companies to have insurance against lawsuits. The insurer then has a market incentive to audit the code.

And the “regulatory” solution? You’re living it. It didn’t work.

DHH: Web app users would be shocked to learn that 99% of the time, deleting your data just sets a flag in the database. And then it just lives there forever until it’s hacked or subpoenaed.

It took a massive effort to ensure this wasn’t the case for Basecamp and HEY. Especially when it comes to deleting log files, database backups, and all the other auxiliary copies of your stuff that most companies just hang onto until the sun burns out.

I mean it didn’t work in terms of preventing the leak but if it bankrupts the company I think I’m fine with that outcome.

One side effect of the hack is we can get maps. I wouldn’t share individuals, but distributions are interesting and there is a clear pattern.

As in, the more central and among more people you live, the less likely you are to use Tea. That makes perfect sense. The smaller your community, the more useful gossip and reputation are as tools. If you’re living in San Francisco proper, the tea is harder to get and also less reliable due to lack of skin in the game.

Tom Harwood notes that this is happening at the same time as the UK mandating photo ID for a huge percentage of websites, opening up lots of new security issues.

As above, for this question divide Tea into its procedural functions, and the crowdsourcing function.

On its procedural functions, these seem good if and only if execution of the features is good and better than alternative apps that do similar things. I can’t speak to that. But yeah, it seems like common sense to do basic checks on anyone you’re considering seriously dating.

On the core crowdsourcing functions I am more skeptical.

Especially if I was considering sharing red flags, I would have more serious ethical concerns especially around invasion of privacy and worry that the information could get out beyond his dating life including back to you in various ways.

If you wouldn’t say it to the open internet, you likely shouldn’t be saying it to Tea. To the extent people are thinking these two things are very different, I believe they are making a serious mistake. And I would be very skeptical of the information I did get. But I’m not going to pretend that I wouldn’t look.

If you have deserved green flags to give out? That seems great. It’s a Mitzvah.

Discussion about this post

Spilling the Tea Read More »

Futurehome smart hub owners must pay new $117 subscription or lose access

Smart Home, subscriptions, Tech / Mike M. / July 29, 2025

Smart home device maker Futurehome is forcing its customers’ hands by suddenly requiring a subscription for basic functionality of its products.

Launched in 2016, Futurehome’s Smarthub is marketed as a central hub for controlling Internet-connected devices in smart homes. For years, the Norwegian company sold its products, which also include smart thermostats, smart lighting, and smart fire and carbon monoxide alarms, for a one-time fee that included access to its companion app and cloud platform for control and automation. As of June 26, though, those core features require a 1,188 NOK (about $116.56) annual subscription fee, turning the smart home devices into dumb ones if users don’t pay up.

“You lose access to controlling devices, configuring; automations, modes, shortcuts, and energy services,” a company FAQ page says.

You also can’t get support from Futurehome without a subscription. “Most” paid features are inaccessible without a subscription, too, the FAQ from Futurehome, which claims to be in 38,000 households, says.

After June 26, customers had four weeks to continue using their devices as normal without a subscription. That grace period recently ended, and users now need a subscription for their smart devices to work properly.

Some users are understandably disheartened about suddenly having to pay a monthly fee to use devices they already purchased. More advanced users have also expressed frustration with Futurehome potentially killing its devices’ ability to work by connecting to a local device instead of the cloud. In its FAQ, Futurehome says it “cannot guarantee that there will not be changes in the future” around local API access.

In response, a Reddit user, according to a Reddit-provided translation of the Norwegian post, said:

I can understand to some extent that they have to do it for services that have ongoing expenses, like servers (even though I actually think it’s their problem, not mine, that they didn’t realize this was a bad idea when they sold me the solution), but a local function that only works internally in the equipment I’ve already paid for shouldn’t be blocked behind a paywall.

According to Futurehome, subscription-less customers can still create, delete, and switch between households, edit household users and owners, and update and factory reset their Futurehome Smarthubs.

Futurehome smart hub owners must pay new $117 subscription or lose access Read More »

Trump caving on Nvidia H20 export curbs may disrupt his bigger trade war

AI, AI chips, Donald Trump, frontier ai, h20 chips, Howard Lutnick, Jensen Huang, NVIDIA, Policy, semiconductors, tariffs, trump tariffs, us-china trade war / Mike M. / July 29, 2025

But experts seem to fear that Trump isn’t paying enough attention to how exports of US technology could threaten to not only supercharge China’s military and AI capabilities but also drain supplies that US firms need to keep the US at the forefront of AI innovation.

“More chips for China means fewer chips for the US,” experts said, noting that “China’s biggest tech firms, including Tencent, ByteDance, and Alibaba,” have spent $16 billion on bulk-ordered H20 chips over the past year.

Meanwhile, “projected data center demand from the US power market would require 90 percent of global chip supply through 2030, an unlikely scenario even without China joining the rush to buy advanced AI chips,” experts said. If Trump doesn’t intervene, one of America’s biggest AI rivals could even end up driving up costs of AI chips for US firms, they warned.

“We urge you to reverse course,” the letter concluded. “This is not a question of trade. It is a question of national security.”

Trump says he never heard of Nvidia before

Perhaps the bigger problem for Trump, national security experts suggest, would be if China or other trade partners perceive the US resolve to wield export controls as a foreign policy tool to be “weakened” by Trump reversing course on H20 controls.

They suggested that Trump caving on H20 controls could even “embolden China to seek additional access concessions” at a time when some analysts suggest that China may already have an upper hand in trade negotiations.

The US and China are largely expected to extend a 90-day truce following recent talks in Stockholm, Reuters reported. Anonymous sources told the South China Morning Post that the US may have already agreed to not impose any new tariffs or otherwise ratchet up the trade war during that truce, but that remains unconfirmed, as Trump continues to warn that chip tariffs are coming soon.

Trump has recently claimed that he thinks he may be close to cementing a deal with China, but it appears likely that talks will continue well into the fall. A meeting between Trump and Chinese President Xi Jinping probably won’t be scheduled until late October or early November, Reuters reported.

Trump caving on Nvidia H20 export curbs may disrupt his bigger trade war Read More »

OpenAI’s ChatGPT Agent casually clicks through “I am not a robot” verification test

agentic AI, AI, AI agents, AI behavior, AI development tools, AI security, authentication, Biz & IT, CAPTCHA, chatgpt, cloudflare, computer use model, Computer-Using Agent, machine learning, openai, Web security / Mike M. / July 29, 2025

The CAPTCHA arms race

While the agent didn’t face an actual CAPTCHA puzzle with images in this case, successfully passing Cloudflare’s behavioral screening that determines whether to present such challenges demonstrates sophisticated browser automation.

To understand the significance of this capability, it’s important to know that CAPTCHA systems have served as a security measure on the web for decades. Computer researchers invented the technique in the 1990s to screen bots from entering information into websites, originally using images with letters and numbers written in wiggly fonts, often obscured with lines or noise to foil computer vision algorithms. The assumption is that the task will be easy for humans but difficult for machines.

Cloudflare’s screening system, called Turnstile, often precedes actual CAPTCHA challenges and represents one of the most widely deployed bot-detection methods today. The checkbox analyzes multiple signals, including mouse movements, click timing, browser fingerprints, IP reputation, and JavaScript execution patterns to determine if the user exhibits human-like behavior. If these checks pass, users proceed without seeing a CAPTCHA puzzle. If the system detects suspicious patterns, it escalates to visual challenges.

The ability for an AI model to defeat a CAPTCHA isn’t entirely new (although having one narrate the process feels fairly novel). AI tools have been able to defeat certain CAPTCHAs for a while, which has led to an arms race between those that create them and those that defeat them. OpenAI’s Operator, an experimental web-browsing AI agent launched in January, faced difficulty clicking through some CAPTCHAs (and was also trained to stop and ask a human to complete them), but the latest ChatGPT Agent tool has seen a much wider release.

It’s tempting to say that the ability of AI agents to pass these tests puts the future effectiveness of CAPTCHAs into question, but for as long as there have been CAPTCHAs, there have been bots that could later defeat them. As a result, recent CAPTCHAs have become more of a way to slow down bot attacks or make them more expensive rather than a way to defeat them entirely. Some malefactors even hire out farms of humans to defeat them in bulk.

OpenAI’s ChatGPT Agent casually clicks through “I am not a robot” verification test Read More »

Meta pirated and seeded porn for years to train AI, lawsuit says

adult content, adult sites, AI, ai porn, AI training, AI training data, Ai video generator, BItTorrent, copyright infringement, LLaMA, Meta, online piracy, Policy, porn, seeding, torrenting / Mike M. / July 28, 2025

Evidence may prove Meta seeded more content

Seeking evidence to back its own copyright infringement claims, Strike 3 Holdings searched “its archive of recorded infringement captured by its VXN Scan and Cross Reference tools” and found 47 “IP addresses identified as owned by Facebook infringing its copyright protected Works.”

The data allegedly demonstrates a “continued unauthorized distribution” over “several years.” And Meta allegedly did not stop its seeding after Strike 3 Holdings confronted the tech giant with this evidence—despite the IP data supposedly being verified through an industry-leading provider called Maxmind.

Strike 3 Holdings shared a screenshot of MaxMind’s findings. Credit: via Strike 3 Holdings’ complaint

Meta also allegedly attempted to “conceal its BitTorrent activities” through “six Virtual Private Clouds” that formed a “stealth network” of “hidden IP addresses,” the lawsuit alleged, which seemingly implicated a “major third-party data center provider” as a partner in Meta’s piracy.

An analysis of these IP addresses allegedly found “data patterns that matched infringement patterns seen on Meta’s corporate IP Addresses” and included “evidence of other activity on the BitTorrent network including ebooks, movies, television shows, music, and software.” The seemingly non-human patterns documented on both sets of IP addresses suggest the data was for AI training and not for personal use, Strike 3 Holdings alleged.

Perhaps most shockingly, considering that a Meta employee joked “torrenting from a corporate laptop doesn’t feel right,” Strike 3 Holdings further alleged that it found “at least one residential IP address of a Meta employee” infringing its copyrighted works. That suggests Meta may have directed an employee to torrent pirated data outside the office to obscure the data trail.

The adult site operator did not identify the employee or the major data center discussed in its complaint, noting in a subsequent filing that it recognized the risks to Meta’s business and its employees’ privacy of sharing sensitive information.

In total, the company alleged that evidence shows “well over 100,000 unauthorized distribution transactions” linked to Meta’s corporate IPs. Strike 3 Holdings is hoping the evidence will lead a jury to find Meta liable for direct copyright infringement or charge Meta with secondary and vicarious copyright infringement if the jury finds that Meta successfully distanced itself by using the third-party data center or an employee’s home IP address.

“Meta has the right and ability to supervise and/or control its own corporate IP addresses, as well as the IP addresses hosted in off-infra data centers, and the acts of its employees and agents infringing Plaintiffs’ Works through their residential IPs by using Meta’s AI script to obtain content through BitTorrent,” the complaint said.

Meta pirated and seeded porn for years to train AI, lawsuit says Read More »

Ars spoke with the military’s chief orbital traffic cop—here’s what we learned

china, Features, military space, raj agrawal, russia, Science, Space, space debris, space traffic management, US Space Force / Mike M. / July 28, 2025

“We have some 2,000 or 2,200 objects that I call the ‘red order of battle.'”

Col. Raj Agrawal participates in a change of command ceremony to mark his departure from Mission Delta 2 at Peterson Space Force Base, Colorado. Col. Barry Croker became the new commander of Mission Delta 2 on July 3.

For two years, Col. Raj Agrawal commanded the US military unit responsible for tracking nearly 50,000 human-made objects whipping through space. In this role, he was keeper of the orbital catalog and led teams tasked with discerning whether other countries’ satellites, mainly China and Russia, are peaceful or present a military threat to US forces.

This job is becoming more important as the Space Force prepares for the possibility of orbital warfare.

Ars visited with Agrawal in the final weeks of his two-year tour of duty as commander of Mission Delta 2, a military unit at Peterson Space Force Base, Colorado. Mission Delta 2 collects and fuses data from a network of sensors “to identify, characterize, and exploit opportunities and mitigate vulnerabilities” in orbit, according to a Space Force fact sheet.

This involves operating radars and telescopes, analyzing intelligence information, and “mapping the geocentric space terrain” to “deliver a combat-ready common operational picture” to military commanders. Agrawal’s job has long existed in one form or another, but the job description is different today. Instead of just keeping up with where things are in space—a job challenging enough—military officials now wrestle with distinguishing which objects might have a nefarious purpose.

From teacher to commander

Agrawal’s time at Mission Delta 2 ended on July 3. His next assignment will be as Space Force chair at the National Defense University. This marks a return to education for Agrawal, who served as a Texas schoolteacher for eight years before receiving his commission as an Air Force officer in 2001.

“Teaching is, I think, at the heart of everything I do,” Agrawal said.

He taught music and math at Trimble Technical High School, an inner city vocational school in Fort Worth. “Most of my students were in broken homes and unfortunate circumstances,” Agrawal said. “I went to church with those kids and those families, and a lot of times, I was the one bringing them home and taking them to school. What was [satisfying] about that was a lot of those students ended up living very fulfilling lives.”

Agrawal felt a calling for higher service and signed up to join the Air Force. Given his background in music, he initially auditioned for and was accepted into the Air Force Band. But someone urged him to apply for Officer Candidate School, and Agrawal got in. “I ended up on a very different path.”

Agrawal was initially accepted into the ICBM career field, but that changed after the September 11 attacks. “That was a time with anyone with a name like mine had a hard time,” he said. “It took a little bit of time to get my security clearance.”

Instead, the Air Force assigned him to work in space operations. Agrawal quickly became an instructor in space situational awareness, did a tour at the National Reconnaissance Office, then found himself working at the Pentagon in 2019 as the Defense Department prepared to set up the Space Force as a new military service. Agrawal was tasked with leading a team of 100 people to draft the first Space Force budget.

Then, he received the call to report to Peterson Space Force Base to take command of what is now Mission Delta 2, the inheritor of decades of Air Force experience cataloging everything in orbit down to the size of a softball. The catalog was stable and predictable, lingering below 10,000 trackable objects until 2007. That’s when China tested an anti-satellite missile, shattering an old Chinese spacecraft into more than 3,500 pieces large enough to be routinely detected by the US military’s Space Surveillance Network.

This graph from the European Space Agency shows the growing number of trackable objects in orbit. Credit: European Space Agency

Two years later, an Iridium communications satellite collided with a defunct Russian spacecraft, adding thousands more debris fragments to low-Earth orbit. A rapid uptick in the pace of launches since then has added to the problem, further congesting busy orbital traffic lanes a hundred miles above the Earth. Today, the orbital catalog numbers roughly 48,000 objects.

“This compiled data, known as the space catalog, is distributed across the military, intelligence community, commercial space entities, and to the public, free of charge,” officials wrote in a fact sheet describing Mission Delta 2’s role at Space Operations Command. Deltas are Space Force military units roughly equivalent to a wing or group command in the Air Force.

The room where it happens

The good news is that the US military is getting better at tracking things in space. A network of modern radars and telescopes on the ground and in space can now spot objects as small as a golf ball. Space is big, but these objects routinely pass close to one another. At speeds of nearly 5 miles per second, an impact will be catastrophic.

But there’s a new problem. Today, the US military must not only screen for accidental collisions but also guard against an attack on US satellites in orbit. Space is militarized, a fact illustrated by growing fleets of satellites—primarily American, Chinese, and Russian—capable of approaching another country’s assets in orbit, and in some cases, disable or destroy them. This has raised fears at the Pentagon that an adversary could take out US satellites critical for missile warning, navigation, and communications, with severe consequences impacting military operations and daily civilian life.

This new reality compelled the creation of the Space Force in 2019, beginning a yearslong process of migrating existing Air Force units into the new service. Now, the Pentagon is posturing for orbital warfare by investing in new technologies and reorganizing the military’s command structure.

Today, the Space Force is responsible for predicting when objects in orbit will come close to one another. This is called a conjunction in the parlance of orbital mechanics. The US military routinely issues conjunction warnings to commercial and foreign satellite operators to give them an opportunity to move their satellites out of harm’s way. These notices also go to NASA if there’s a chance of a close call with the International Space Station (ISS).

The first Trump administration approved a new policy to transfer responsibility for these collision warnings to the Department of Commerce, allowing the military to focus on national security objectives.

But the White House’s budget request for next year would cancel the Commerce Department’s initiative to take over collision warnings. Our discussion with Agrawal occurred before the details of the White House budget were made public last month, and his comments reflect official Space Force policy at the time of the interview. “In uniform, we align to policy,” Agrawal wrote on his LinkedIn account. “We inform policy decisions, but once they’re made, we align our support accordingly.”

US Space Force officials show the 18th Space Defense Squadron’s operations floor to officials from the German Space Situational Awareness Centre during an “Operator Exchange” event at Vandenberg Space Force Base, California, on April 7, 2022. Credit: US Space Force/Tech. Sgt. Luke Kitterman

Since our interview, analysts have also noticed an uptick in interesting Russian activity in space and tracked a suspected Chinese satellite refueling mission in geosynchronous orbit.

Let’s rewind the tape to 2007, the time of China’s game-changing anti-satellite test. Gen. Chance Saltzman, today the Space Force’s Chief of Space Operations, was a lieutenant colonel in command of the Air Force’s 614th Space Operations Squadron at the time. He was on duty when Air Force operators first realized China had tested an anti-satellite missile. Saltzman has called the moment a “pivot point” in space operations. “For those of us that are neck-deep in the business, we did have to think differently from that day on,” Saltzman said in 2023.

Agrawal was in the room, too. “I was on the crew that needed to count the pieces,” he told Ars. “I didn’t know the significance of what was happening until after many years, but the Chinese had clearly changed the nature of the space environment.”

The 2007 anti-satellite test also clearly changed the trajectory of Agrawal’s career. We present part of our discussion with Agrawal below, and we’ll share the rest of the conversation tomorrow. The text has been lightly edited for brevity and clarity.

Ars: The Space Force’s role in monitoring activities in space has changed a lot in the last few years. Can you tell me about these changes, and what’s the difference between what you used to call Space Situational Awareness, and what is now called Space Domain Awareness?

Agrawal: We just finished our fifth year as a Space Force, so as a result of standing up a military service focused on space, we shifted our activities to focus on what the joint force requires for combat space power. We’ve been doing space operations for going on seven decades. I think a lot of folks think that it was a rebranding, as opposed to a different focus for space operations, and it couldn’t be further from the truth. Compared to Space Domain Awareness (SDA), Space Situational Awareness (SSA) is kind of the knowledge we produce with all these sensors, and anybody can do space situational awareness. You have academia doing that. You’ve got commercial, international partners, and so on. But Space Domain Awareness, Gen. [John “Jay”] Raymond coined the term a couple years before we stood up the Space Force, and he was trying to get after, how do we create a domain focused on operational outcomes? That’s all we could say at the time. We couldn’t say war-fighting domain at the time because of the way of our policy, but our policy shifted to being able to talk about space as a place where, not that we want to wage war, but that we can achieve objectives, and do that with military objectives in mind.

We used to talk about detect, characterize, attribute, predict. And then Gen. [Chance] Saltzman added target onto the construct for Space Domain Awareness, so that we’re very much in the conversation of what it means to do a space-enabled attack and being able to achieve objectives in, from, and to space, and using Space Domain Awareness as a vehicle to do those things. So, with Mission Delta 2, what he did is he took the sustainment part of acquisition, software development, cyber defense, intelligence related to Space Domain Awareness, and then all the things that we were doing in Space Domain Awareness already, put all that together under one command … and called us Mission Delta 2. So, the 18th Space Defense Squadron … that used to kind of be the center of the world for Space Domain Awareness, maybe the only unit that you could say was really doing SDA, where everyone else was kind of doing SSA. When I came into command a couple years ago, and we face now a real threat to having space superiority in the space domain, I disaggregated what we were doing just in the 18th and spread out through a couple of other units … So, that way everyone’s got kind of majors and minors, but we can quickly move a mission in case we get tested in terms of cyber defense or other kinds of vulnerabilities.

This multi-exposure image depicts a satellite-filled sky over Alberta. Credit: Alan Dyer/VWPics/Universal Images Group via Getty Images

We can’t see the space domain, so it’s not like the air domain and sea domain and land domain, where you can kind of see where everything is, and you might have radars, but ultimately it’s a human that’s verifying whether or not a target or a threat is where it is. For the space domain, we’re doing all that through radars, telescopes, and computers, so the reality we create for everyone is essentially their reality. So, if there’s a gap, if there’s a delay, if there are some signs that we can’t see, that reality is what is created by us, and that is effectively the reality for everyone else, even if there is some other version of reality in space. So, we’re getting better and better at fielding capability to see the complexity, the number of objects, and then translating that into what’s useful for us—because we don’t need to see everything all the time—but what’s useful for us for military operations to achieve military objectives, and so we’ve shifted our focus just to that.

We’re trying to get to where commercial spaceflight safety is managed by the Office of Space Commerce, so they’re training side by side with us to kind of offload that mission and take that on. We’re doing up to a million notifications a day for conjunction assessments, sometimes as low as 600,000. But last year, we did 263 million conjunction notifications. So, we want to get to where the authorities are rightly lined, where civil or commercial notifications are done by an organization that’s not focused on joint war-fighting, and we focus on the things that we want to focus on.

Ars: Thank you for that overview. It helps me see the canvas for everything else we’re going to talk about. So, today, you’re not only tracking new satellites coming over the horizon from a recent launch or watching out for possible collisions, you’re now trying to see where things are going in space and maybe even try to determine intent, right?

Agrawal: Yeah, so the integrated mission delta has helped us have intel analysts and professionals as part of our formation. Their mission is SDA as much as ours is, but they’re using an intel lens. They’re looking at predictive intelligence, right? I don’t want to give away tradecraft, but what they’re focused on is not necessarily where a thing is. It used to be that all we cared about was position and vector, right? As long as you knew an object’s position and the direction they were going, you knew their orbit. You had predictive understanding of what their element set would be, and you only had to do sampling to get a sense of … Is it kind of where we thought it was going to be? … If it was far enough off of its element set, then we would put more energy, more sampling of that particular object, and then effectively re-catalog it.

Now, it’s a different model. We’re looking at state vectors, and we’re looking at anticipatory modeling, where we have some 2,000 or 2,200 objects that I call the “red order of battle”—that are high-interest objects that we anticipate will do things that are not predicted, that are not element set in nature, but that will follow some type of national interest. So, our intel apparatus gets after what things could potentially be a risk, and what things to continue to understand better, and what things we have to be ready to hold at risk. All of that’s happening through all the organizations, certainly within this delta, but in partnership and in support of other capabilities and deltas that are getting after their parts of space superiority.

Hostile or friendly?

Ars: Can you give some examples of these red order of battle objects?

Agrawal: I think you know about Shijian-20 (a “tech demo” satellite that has evaded inspection by US satellites) and Shijian-24C (which the Space Force says demonstrated “dogfighting” in space), things that are advertised as scientific in nature, but clearly demonstrate capability that is not friendly, and certainly are behaving in ways that are unprofessional. In any other domain, we would consider them hostile, but in space, we try to be a lot more nuanced in terms of how we characterize behavior, but still, when something’s behaving in a way that isn’t pre-planned, isn’t pre-coordinated, and potentially causes hazard, harm, or contest with friendly forces, we now get in a situation where we have to talk about is that behavior hostile or not? Is that escalatory or not? Space Command is charged with those authorities, so they work through the legal apparatus in terms of what the definition of a hostile act is and when something behaves in a way that we consider to be of national security interest.

We present all the capability to be able to do all that, and we have to be as cognizant on the service side as the combatant commanders are, so that our intel analysts are informing the forces and the training resources to be able to anticipate the behavior. We’re not simply recognizing it when it happens, but studying nations in the way they behave in all the other domains, in the way that they set policy, in the way that they challenge norms in other international arenas like the UN and various treaties, and so on. The biggest predictor, for us, of hazardous behaviors is when nations don’t coordinate with the international community on activities that are going to occur—launches, maneuvers, and fielding of large constellations, megaconstellations.

A stack of Starlink satellites in space right before deployment — Starlink satellites. Credit: Starlink

There are nearly 8,000 Starlink satellites in orbit today. SpaceX adds dozens of satellites to the constellation each week. Credit: SpaceX

As you know, we work very closely with Starlink, and they’re very, very responsible. They coordinate and flight plan. They use the kind of things that other constellations are starting to use … changes in those elsets (element sets), for lack of a better term, state vectors, we’re on top of that. We’re pre-coordinating that. We’re doing that weeks or months in advance. We’re doing that in real-time in cooperation with these organizations to make sure that space remains safe, secure, accessible, profitable even, for industry. When you have nations, where they’re launching over their population, where they’re creating uncertainty for the rest of the world, there’s nothing else we can do with it other than treat that as potentially hostile behavior. So, it does take a lot more of our resources, a lot more of our interest, and it puts [us] in a situation where we’re posturing the whole joint force to have to deal with that kind of uncertainty, as opposed to cooperative launches with international partners, with allies, with commercial, civil, and academia, where we’re doing that as friends, and we’re doing that in cooperation. If something goes wrong, we’re handling that as friends, and we’re not having to involve the rest of the security apparatus to get after that problem.

Ars: You mentioned that SpaceX shares Starlink orbit information with your team. Is it the same story with Amazon for the Kuiper constellation?

Agrawal: Yeah, it is. The good thing is that all the US and allied commercial entities, so far, have been super cooperative with Mission Delta 2 in particular, to be able to plan out, to talk about challenges, to even change the way they do business, learning more about what we are asking of them in order to be safe. The Office of Space Commerce, obviously, is now in that conversation as well. They’re learning that trade and ideally taking on more of that responsibility. Certainly, the evolution of technology has helped quite a bit, where you have launches that are self-monitored, that are able to maintain their own safety, as opposed to requiring an entire apparatus of what was the US Air Force often having to expend a tremendous amount of resources to provide for the safety of any launch. Now, technology has gotten to a point where a lot of that is self-monitored, self-reported, and you’ll see commercial entities blow up their own rockets no matter what’s onboard if they see that it’s going to cause harm to a population, and so on. So, yeah, we’re getting a lot of cooperation from other nations, allies, partners, close friends that are also sharing and cooperating in the interest of making sure that space remains sustainable and secure.

“We’ve made ourselves responsible”

Ars: One of the great ironies is that after you figure out the positions and tracks of Chinese or Russian satellites or constellations, you’re giving that data right back to them in the form of conjunction and collision notices, right?

Agrawal: We’ve made ourselves responsible. I don’t know that there’s any organization holding us accountable to that. We believe it’s in our interests, in the US’s interests, to provide for a safe, accessible, secure space domain. So, whatever we can do to help other nations also be safe, we’re doing it certainly for their sake, but we’re doing it as much for our sake, too. We want the space domain to be safe and predictable. We do have an apparatus set up in partnership with the State Department, and with a tremendous amount of oversight from the State Department, and through US Space Command to provide for spaceflight safety notifications to China and Russia. We send notes directly to offices within those nations. Most of the time they don’t respond. Russia, I don’t recall, hasn’t responded at all in the past couple of years. China has responded a couple of times to those notifications. And we hope that, through small measures like that, we can demonstrate our commitment to getting to a predictable and safe space environment.

A model of a Chinese satellite refueling spacecraft on display during the 13th China International Aviation and Aerospace Exhibition on October 1, 2021, in Zhuhai, Guangdong Province of China. Credit: Photo by VCG/VCG via Getty Images

Ars: What does China say in response to these notices?

Agrawal: Most of the time it’s copy or acknowledged. I can only recall two instances where they’ve responded. But we did see some hope earlier this year and last year, where they wanted to open up technical exchanges with us and some of their [experts] to talk about spaceflight safety, and what measures they could take to open up those kinds of conversations, and what they could do to get a more secure, safer pace of operations. That, at some point, got delayed because of the holiday that they were going through, and then those conversations just halted, or at least progress on getting those conversations going halted. But we hope that there’ll be an opportunity again in the future where they will open up those doors again and have those kinds of conversations because, again, transparency will get us to a place where we can be predictable, and we can all benefit from orbital regimes, as opposed to using them exploitively. LEO is just one of those places where you’re not going to hide activity there, so you just are creating risk, uncertainty, and potential escalation by launching into LEO and not communicating throughout that whole process.

Ars: Do you have any numbers on how many of these conjunction notices go to China and Russia? I’m just trying to get an idea of what proportion go to potential adversaries.

Agrawal: A lot. I don’t know the degree of how many thousands go to them, but on a regular basis, I’m dealing with debris notifications from Russian and Chinese ASAT (anti-satellite) testing. That has put the ISS at risk a number of times. We’ve had maneuvers occur in recent history as a result of Chinese rocket body debris. Debris can’t maneuver, and unfortunately, we’ve gotten into situations with particularly those two nations that talk about wanting to have safer operations, but continue to conduct debris-causing tests. We’re going to be dealing with that for generations, and we are going to have to design capability to maneuver around those debris clouds as just a function of operating in space. So, we’ve got to get to a point where we’re not doing that kind of testing in orbit.

Ars: Would it be accurate to say you send these notices to China and Russia daily?

Agrawal: Yeah, absolutely. That’s accurate. These debris clouds are in LEO, so as you can imagine, as those debris clouds go around the Earth every 90 minutes, we’re dealing with conjunctions. There are some parts of orbits that are just unusable as a result of that unsafe ASAT test.

Stephen Clark is a space reporter at Ars Technica, covering private space companies and the world’s space agencies. Stephen writes about the nexus of technology, science, policy, and business on and off the planet.

Ars spoke with the military’s chief orbital traffic cop—here’s what we learned Read More »

Peacemaker S2 trailer finds our anti-hero in a parallel world

culture, Entertainment, HBO Max, Peacemaker, san diego comic con, streaming television, Trailers / Mike M. / July 28, 2025

HBO Max dropped the hotly anticipated full trailer for S2 of Peacemaker—James Gunn’s Emmy-nominated series spun off from his 2021 film, The Suicide Squad—at San Diego Comic-Con this weekend.

(Spoilers for S1 below.)

As previously reported, the eight-episode first season was set five months after the events of The Suicide Squad. Having survived a near-fatal shooting, Peacemaker—aka Christopher Smith—is recruited by the US government for a new mission: the mysterious Project Butterfly, led by a mercenary named Clemson Murn (Chukwudi Iwuji). The team also includes A.R.G.U.S. agent John Economos (Steve Agee) of the Belle Reve Penitentiary, National Security Agency agent and former Waller aide Emilia Harcourt (Jennifer Holland), and new team member Leota Adebayo (Danielle Brooks).

Project Butterfly turned out to be a mission to save Earth from an alien species of parasitic butterfly-like creatures who took over human bodies. The misfit members of the project eventually succeeded in defeating the butterflies in a showdown at a ranch, and even survived the carnage despite some severe injuries.

Cena, Brooks, Holland, Agee, and Stroma are all back for S2, along with Nhut Lee as Judomaster and Eagly, of course. Robert Patrick is also listed in the S2 cast, reprising his role as Chris’ father, Auggie. New cast members include Frank Grillo as Rick Flagg Sr. (Grillo voiced the role in the animated Creature Commandos), now head of A.R.G.U.S. and out to avenge his son’s death; Tim Meadows as A.R.G.U.S. agent Langston Fleury; Sol Rodriguez as Sasha Bordeaux; and Michael Rooker as Red St. Wild, described as Eagly’s “nemesis.”

The events of S1 played out within the old DCEU, while S2 takes place in the new DCU, but Gunn has said that those earlier events are nonetheless considered “canon,” apart from the cameos by DCEU Justice League members. S2 is part of Gunn’s “Gods and Monsters” slate; Cena’s Peacemaker even made a brief cameo in Superman. This time around, Chris will be struggling “to reconcile his past with his newfound sense of purpose while continuing to kick righteous evil-doer butt in his misguided quest for peace at any cost,” per the official synopsis.

Peacemaker S2 trailer finds our anti-hero in a parallel world Read More »

Supply-chain attacks on open source software are getting out of hand

Biz & IT, Open Source, repositories, Security, supply chain attacks / Mike M. / July 27, 2025

sudo rm -rf --no-preserve-root /

The –no-preserve-root flag is specifically designed to override safety protections that would normally prevent deletion of the root directory.

The postinstall script that includes a Windows-equivalent destructive command was:

rm /s /q

Socket published a separate report Wednesday on yet more supply-chain attacks, one targeting npm users and another targeting users of PyPI. As of Wednesday, the four malicious packages—three published to npm and the fourth on PyPI—collectively had been downloaded more than 56,000 times. Socket said it was working to get them removed.

When installed, the packages “covertly integrate surveillance functionality into the developer’s environment, enabling keylogging, screen capture, fingerprinting, webcam access, and credential theft,” Socket researchers wrote. They added that the malware monitored and captured user activity and transmitted it to attacker-controlled infrastructure. Socket used the term surveillance malware to emphasize the covert observation and data exfiltration tactics “in the context of malicious dependencies.”

Last Friday, Socket reported the third attack. This one compromised an account on npm and used the access to plant malicious code inside three packages available on the site. The compromise occurred after the attackers successfully obtained a credential token that the developer used to authenticate to the site.

The attackers obtained the credential through a targeted phishing attack Socket had disclosed hours earlier. The email instructed the recipient to log in through a URL on npnjs.com. The site is a typosquatting spoof of the official npmjs.com domain. To make the attack more convincing, the phishing URL contained a token field that mimicked tokens npm uses for authentication. The phishing URL was in the format of https://npnjs.com/login?token=xxxxxx where the xxxxxx represented the token.

A phishing email targeting npm account holders. Credit: Socket

Also compromised was an npm package known as ‘is.’ It receives roughly 2.8 million downloads weekly.

Potential for widespread damage

Supply-chain attacks like the ones Socket has flagged have the potential to cause widespread damage. Many packages available in repositories are dependencies, meaning the dependencies must be incorporated into downstream packages for those packages to work. In many developer flows, new dependency versions are downloaded and incorporated into the downstream packages automatically.

The packages flagged in the three attacks are:

@toptal/picasso-tailwind
@toptal/picasso-charts
@toptal/picasso-shared
@toptal/picasso-provider
@toptal/picasso-select
@toptal/picasso-quote
@toptal/picasso-forms
@xene/core
@toptal/picasso-utils
@toptal/picasso-typography.
is version 3.3.1, 5.0.0
got-fetch version 5.1.11, 5.1.12
Eslint-config-prettier, versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7
Eslint-plugin-prettier, versions 4.2.2 and 4.2.3
Synckit, version 0.11.9
@pkgr/core, version 0.2.8
Napi-postinstall, version 0.3.1

Developers who work with any of the packages targeted should ensure none of the malicious versions have been installed or incorporated into their wares. Developers working with open source packages should:

Monitor repository visibility changes in search of suspicious or unusual publishing of packages
Review package.json lifecycle scripts before installing dependencies
Use automated security scanning in continuous integration and continuous delivery pipelines
Regularly rotate authentication tokens
Use multifactor authentication to safeguard repository accounts

Additionally, repositories that haven’t yet made MFA mandatory should do so in the near future.

Supply-chain attacks on open source software are getting out of hand Read More »

Author name: Mike M.