> The attack seems to work by spanning various instructions that if run through macOS’s Terminal utility could steal stored credentials from Chromium-based browsers along with data from cryptocurrency wallets, placing them into a zip archive then sent to a hacker-controlled domain.
What is it about Chromium based browsers that this attack narrows down to? Is it something technical in the ease of stealing information or just the imagined market share by the attackers? As per Cloudflare’s statistics browser share on macOS [1], it seems like Google Chrome users are a little less than two thirds of the total user base. But Safari still holds one third of the user base. Ignoring Safari seems like a poor mistake.
I’ve used Wire in the past and liked that it uses email addresses for registration (as pointed out in this article). Wire also had multi-device message sync long before Signal did.
But on a different point, Wire is inferior to Signal. Signal has a painfully slow data transfer when switching devices. But given some time, the data transfer does work completely.
On Wire, my experience has been that all media in chats are stored on the Wire servers and the backups don’t contain the media. They contain links to the media, while the media may be erased on the servers after sometime. I’ve lost a lot of media from chats on Wire when switching devices and restoring the backup from the original device. Only the text of the messages remain. At that time, Wire’s backups were also device/platform specific.
Since I place a very high level of importance on retaining and transferring data, I wouldn’t recommend Wire to anyone who wants to retain chats for longer durations.
> But when readers realised that Meta was trying to suppress it, the book became a global phenomenon. To date we’ve sold almost 200,000 copies.
The number of copies sold seems quite low for this book. It’s difficult to believe that across paperback, hardcover, ebooks and audiobooks, it hasn’t sold several million copies. This report is from February 2026 (just a month and a half ago).
> HTML entities are often decoded automatically by server-side libraries, which means that even the most basic harvesters can get your email addresses without any special effort. This technique should be worthless—and, yet, it still stops most harvesters.
Anecdotal, but I’ve used HTML entities on a public static website for a long time using an href tag with mailto, and yet I’ve not seen any spam.
I guess any spammer who uses some level of GenAI to process and extract email addresses would have a lot more success against all the methods listed in this article.
The promise is that it informs you quickly about flight delays, flight cancellations and gate changes. In my limited experience, it didn’t work satisfactorily for a flight delay of a few hours. It could not provide any reliable updates.
It’s a nice app and service, but I wouldn’t trust all those reviews that are like “I knew before the aircraft pilot knew”. It has its own limitations.
In a way, this is like saying that one trusts total strangers in some random large tech company and total strangers in government agencies to read and/or manipulate conversations that kids have. This also paves the way to disallow E2EE for other classes of people based on arbitrary criteria. I don’t believe this is good for society overall.
Do you have any recommended links for such a setup? I don’t connect my TV to the network and use it with an Apple TV. But I’m interested to know more on this.
> Is there any smart TV that I can actually just use a TV how I want?
I’ve heard that large computer monitors and TVs intended to be used as displays can be used without connecting them to a network.
> Or am I reduced to buying an Apple TV device and unplugging the TV from the internet entirely ?
An Apple TV is a good choice even otherwise. I’ve never seen a smoother and quicker interface on a native Smart TV (granted that I’ve only seen Android and webOS). I use my Apple TV as the only network connected device while my TV is not connected to any network ever. Once in a while, I update the TV’s firmware by downloading it to a thumb drive and plugging that into the USB port of the TV.
This is quite surprising to me, since I thought the percentage would be a lot lesser.
But I don’t really know what the Firefox team does with crash reports and in making Firefox almost crash proof.
I have been using it at work on Windows and for the last several years it always crashes on exit. I have religiously submitted every crash report. I even visit the “about:crashes” page to see if there are any unsubmitted ones and submit them. Occasionally I’ll click on the bugzilla link for a crash, only to see hardly any action or updates on those for months (or longer).
Granted that I have a small bunch of extensions (all WebExtensions), but this crash-on-exit happens due to many different causes, as seen in the crash reports. I’m too loathe to troubleshoot with disabling all extensions and then trying it one by one. Why should an extension even cause a crash, especially when its a WebExtension (unlike the older XUL extensions that had a deeper integration into the browser)? It seems like there are fundamental issues within Firefox that make it crash prone.
I can make Firefox not crash if I have a single window with a few tabs. That use case is anyway served by Edge and Chrome. The main reasons I use Firefox, apart from some ideological ones, are that it’s always been much better at handling multiple windows and tons of tabs and its extensibility (Manifest V2 FTW).
I would sincerely appreciate Firefox not crashing as often for me.
I don’t know, but it seems like it’s overselling its capabilities. I tried with Firefox Focus and it said I’m using incognito (private mode) and assigned a unique visitor ID. Immediately tried with a private tab in Safari on iOS and it said I’m not using incognito (private mode) and assigned a new unique visitor ID. Then I switched networks and tried. One more unique visitor ID.
I’m not claiming that fingerprinting is not possible, but this website is not good at it. Seems like it uses plain cookies.
When I use Windows, Everything is one of the first tools I install. I also disable Windows search and indexing.
I use this with Keypirinha [1], which is a launcher (kinda like Quicksilver [2] on Mac) that integrates with Everything using the Everything package. [3]
This combo makes finding files as well as launching programs (or doing quick calculations or currency conversions) a breeze!
It doesn’t explicitly state anything about the email contents in the privacy policy page. People generally trust their email providers to not snoop in their emails. I wonder why anyone should trust a cloud based service (such as this).
If you have a Pro or Pro Max model of iPhone from the last several years, it has a LiDAR that allows the pre-installed Measure app to measure lengths/heights, etc., using the camera. Several higher end Android phones may also have the same.
> You can search "!w Gabriel Weinberg" and it will open the Wikipedia article because of the leading exclamation mark and w
Just for anyone else who isn’t aware, the bang commands can be anywhere in the search string, and need not necessarily be at the beginning.
All these queries will take you to Wikipedia for the term:
"!w Gabriel Weinberg"
"Gabriel !w Weinberg"
"Gabriel Weinberg !w"
Many a times when I find the default DuckDuckGo search results inadequate and want to go to Google search, I just put a “!g” as a separate term anywhere within the search string and hit enter. This is especially useful on mobile where the search string may be a lot longer than the visible text box and I can’t be bothered to move the cursor.
I love that duck.ai provides a more private way to use different smaller and medium (?) scale LLMs.
I don’t like the duck.ai interface much (choosing a different LLM is not easy once you’re already in a conversation), but I use it a lot more than I use the DuckDuckGo search engine (the results from the latter aren’t great).
Just like with DuckDuckGo search, where I start a search and then use the !g bang command to go to Google for better results if needed, I try duck.ai and then move to ChatGPT (without any account) when even the best models in duck.ai aren’t good enough.
For most simpler queries though — where I’m just looking to learn a bit about something as opposed to finding a solution for a specific (more complex) question or problem — duck.ai with its GPT 5 models are more than adequate (even the 4o mini is fine).
A couple of quick observations and comments after skimming through this (some of these are mentioned or hinted at in the RFC).
With HTTPS used almost everywhere, using this QUERY method (when standardized) could prevent bookmarking specific “GET” URLs if the developers thoughtlessly replace GET everywhere with QUERY.
One of the advantages of GET is the direct visibility, which makes modifications simple and easy for almost anyone (end users, testers, etc.).
The larger question I have is who will choose to adopt it sooner, with web servers, web application frameworks and web browsers in the mix.
I read through this. I don't think Proton Mail is a good replacement for Signal (it's worse because Proton does log and share IP addresses of users with a court order).
One thing I dislike about Signal on its privacy posture is that the moment you register, anyone who already has Signal and has your phone number in their contacts list will get a message saying you're on Signal. This is a good way for others with bad intentions to know about your presence on the platform. The options to hide your phone number are available only after registering on Signal (after this broadcast has already happened) and when the user figures out that this is possible somewhere deep in the settings.
On registration Signal could ask whether to inform all random people who happen to have your number. But since unused/discarded phone numbers are recycled by carriers to other customers within a matter of weeks or months or years (depending on where you are), your presence on Signal may be sent to someone you've never ever known or has known you. Signal ought to remove this broadcast on registration. Telegram (and I guess WhatsApp) also suffer from the same issue.
Never on iOS or any other Apple platform. Signal is designed not to be able to backup to iCloud either. The only option iOS users have had over the last few years is to do a device to device transfer where both phones are expected to be in physical proximity and it takes hours to transfer the data. Lost phone has meant losing all chats.
WhatsApp, which is infamous by association with Meta, backs up to Google Drive or wherever.
What is it about Chromium based browsers that this attack narrows down to? Is it something technical in the ease of stealing information or just the imagined market share by the attackers? As per Cloudflare’s statistics browser share on macOS [1], it seems like Google Chrome users are a little less than two thirds of the total user base. But Safari still holds one third of the user base. Ignoring Safari seems like a poor mistake.
[1]: https://radar.cloudflare.com/reports/browser-market-share-20...