Do you want to have a good time? You know, really enjoy yourself? Click here, and tell us your desires. Maybe it’s a new outfit, or some exotic cuisine delivered anonymously and steaming hot to your door. Maybe it’s porn or gambling. Perhaps you prefer the infinite scroll, the endlessly unfurling ribbon of glossy images and videos starring people you’ll never meet doing things you’ll never do. Or maybe you favor talking to a chatbot who will assure you that you are the most special of all its users.

For anyone with an Internet connection and a little discretionary income, the contemporary moment offers a superabundance of seductive distractions. Why then the pervasive mood of emptiness? Why are so many at once overstimulated and bored?

Do you want to have a good time? You know, really enjoy yourself? Click here, and tell us your desires. Maybe it’s a new outfit, or some exotic cuisine delivered anonymously and steaming hot to your door. Maybe it’s porn or gambling. Perhaps you prefer the infinite scroll, the endlessly unfurling ribbon of glossy images and videos starring people you’ll never meet doing things you’ll never do. Or maybe you favor talking to a chatbot who will assure you that you are the most special of all its users.

For anyone with an Internet connection and a little discretionary income, the contemporary moment offers a superabundance of seductive distractions. Why then the pervasive mood of emptiness? Why are so many at once overstimulated and bored?

The post Induction Labs Photon-1 Simulates Desktops, Plays Checkers, and Models Billiard Physics From One Pretraining Run appeared first on MarkTechPost.

As a small boy growing up in Amritsar, India, in the 1960s, Avtar Singh used to hear whispers. Your mum isn’t really your mum, the rumours would say. Your mum lives abroad. Avtar didn’t really pay any attention to it. “I thought, the neighbours are just making up stories.” But the stories were true: the woman raising Avtar was actually his grandmother. When he was too young to remember it, his father had emigrated to Canada to work as a teacher, leaving Avtar in the care of his paternal grandparents. His grandfather, a police officer, was a fearsome authoritarian, but his grandmother brought him up with tenderness, as if he were her own son. She called him by his nickname, Titu. He felt loved.

When Avtar was around eight years old, he was told about his family in Canada: his dad, his mum and a little brother were waiting for him there, and he would soon travel to join them. Just after his ninth birthday, Avtar found himself sitting on a plane, dressed in a three‑piece suit and tie. He was travelling alone. He had never flown before. He didn’t speak a word of English. He landed in Halifax, Nova Scotia, on Christmas Eve, 1968; his family met him at the airport and took him home. “I didn’t know what to think,” Avtar, now 66, tells me in a video call from his home in Abbotsford, British Columbia. “Before I knew it, it was the first week of January, and I was put in school.”

In case you missed it: learn all about the magical mystery musical badge from DEF CON 30 in the opening talk for DC30 with The Dark Tangent and MKFactor, the badge creators.

A remote code execution vulnerability exists in the HTTP Protocol Stack for Microsoft Internet Information Services implemented in HTTP.sys. The vulnerability is due to invalid validating incoming HTTP requests.

A remote, unauthenticated attacker can exploit this vulnerability by sending crafted HTTP packets to the target system. Successful exploitation of this vulnerability can result in a denial-of-service condition, or, in the worst case, code execution with kernel privileges.

The Vulnerability

HTTP.sys is the kernel-mode HTTP protocol driver in Microsoft Windows. It provides HTTP request parsing, response caching, and SSL/TLS termination for Internet Information Services (IIS) and other applications that register URL prefixes. The driver listens on configured TCP ports (commonly 80 for HTTP and 443 for HTTPS) and processes inbound HTTP/1.x and HTTP/2 requests at the kernel level.

When operating over HTTPS, HTTP.sys delegates TLS processing to the Windows Secure Channel (SChannel) provider. Inbound TCP data is decrypted on a per-record basis: each TLS record constitutes an independent unit of encryption and is decrypted separately by SChannel before being delivered to HTTP.sys as a distinct plaintext buffer. A single TLS 1.3 application data record has the following structure:

The decrypted payload of each TLS record is delivered independently to the HTTP parser via

UlHttpBufferReceiveEvent(), regardless of how many TLS records the underlying TCP connection coalesces into a single TCP segment. This behavior is distinct from plaintext HTTP connections, where the Windows TCP stack coalesces multiple segments into a single receive indication before the data reaches HTTP.sys.

The HTTP parser maintains a per-request state object that includes a dynamically grown buffer reference array. The capacity field stores the current number of allocated slots in the buffer reference array. The count field stores the number of slots currently in use. The ref_array_ptr field points to the dynamically allocated array of 8-byte buffer reference entries.

An integer overflow vulnerability exists in HTTP.sys. The vulnerability is due to insufficient bounds checking when growing a buffer reference array during HTTP/1.x header parsing. When HTTP.sys receives data for an HTTP/1.x request, it allocates a UL_REQUEST_BUFFER structure for each receive indication and tracks these buffers in the per-request reference array described above. The count field records the number of active buffer references, and the capacity field records the total number of allocated slots.

As the HTTP parser (UlpParseNextRequest()) processes header lines, it calls an inline buffer reference routine each time a new receive buffer is consumed. When count reaches capacity, the routine grows the array by reallocating it with five additional slots. The new allocation size is computed as 0x28 + capacity * 8, the contents of the existing array are copied via memmove using count * 8 as the copy length, and capacity is incremented by 5 as a 16-bit unsigned integer addition. No overflow check is performed on this addition.

After 13,107 growth events, capacity reaches 0xFFFB. The next growth adds 5, producing 0x10000, which truncates to 0x0000 in the 16-bit field. On the subsequent buffer reference addition, count (which is now 65,536 or greater) exceeds the zero capacity, triggering another growth. The allocation size computation 0x28 + 0 * 8 produces a 40-byte allocation, but the memmove copies count * 8 bytes (approximately 524,256 bytes) from the old buffer into the 40-byte allocation. This results in a kernel pool heap buffer overflow of over 500 kilobytes.

Each buffer reference corresponds to one receive buffer delivered to the HTTP parser. For plaintext HTTP connections, the Windows TCP stack coalesces received segments into large indications, and UlpMergeBuffers() further combines buffers within HTTP.sys. Over TLS connections, each TLS record is decrypted independently by SChannel and delivered as a separate buffer through UlHttpBufferReceiveEvent() into UlpCopyIndicatedData(). If each TLS record contains exactly one complete header line (terminated by CRLF), the HTTP parser fully consumes the buffer without setting the partial-parse flag, causing UlpAdjustBuffers() to advance to the next buffer via its non-merge path. This creates a 1:1 correspondence between TLS records sent and buffer references accumulated.

To trigger the overflow, an attacker crafts an HTTP request in which each header line is encapsulated in a separate TLS application data record. Given a minimum header line size of approximately 4 bytes and a required count of 65,536 buffer references, the total request size comes to roughly 262,144 bytes. The MaxRequestBytes registry value (at HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters) must be configured to a value of at least 262,144 bytes for the server to accept a request of this size. The default value of 16,384 bytes limits the request to approximately 4000 header lines, which is insufficient to trigger the overflow. As a mitigation, keeping MaxRequestBytes at or below 65,535 bytes represents the most conservative configuration to prevent this attack.

A remote unauthenticated attacker could exploit this vulnerability by sending a specially crafted HTTP/1.x request over a TLS connection to an affected server. Successful exploitation results in unexpected system termination due to a memory access exception in the context of the kernel. Under specific memory layout conditions, exploitation could result in arbitrary code execution in the context of the kernel.

Notes:

• The vulnerability is only reachable through HTTP/1.x header parsing over TLS connections. HTTP/2 and HTTP/3 use different parser paths that do not interact with the buffer reference array.

• Body data parsing (Content-Length or chunked transfer encoding) does not add entries to the buffer reference array. Only header parsing triggers buffer reference growth.

• At a sending rate of 10 milliseconds per TLS record, the overflow requires approximately 11 minutes to trigger.

Source Code Walkthrough

The following code snippet was taken from HTTP.sys version 10.0.26100.7705. Comments added by TrendAI Research have been highlighted.

In UlpParseNextRequest():

Detection Guidance

To detect an attack exploiting this vulnerability, the detection device must monitor and parse traffic on the TCP port 443.

The traffic on the affected port(s) is TLS-encrypted. The detection device must be able to decrypt the TLS traffic before applying the following detection method. The detection device should monitor for HTTPS connections.

An HTTP/1.x request [1] consists of a request line followed by zero or more header field lines, each terminated by CRLF. The following grammar defines the relevant structure:

Decrypted traffic inspection:

After decrypting the TLS session, the detection device must parse the HTTP/1.x request headers. The detection device must count the number of distinct header field lines present in a single HTTP request. If the number of header field lines in a single request exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Encrypted traffic heuristics:

Where decryption is not available, the detection device should inspect the pattern of TLS application data records within the encrypted session. If each TLS application data record contains a single short payload and the total number of such records on a single connection exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Notes:

• The preferred detection method (header line count) requires the ability to decrypt TLS traffic, for example through TLS inspection, a decrypting proxy, or possession of the server's private key. This method directly observes the attack indicator and produces low false-positive and false-negative rates.

• The TLS record heuristic operates on encrypted traffic and does not require decryption. This method is more prone to false positives (legitimate applications that send many small TLS records, such as interactive streaming sessions, may trigger the heuristic) and to false negatives (the threshold is based on observable record sizes rather than the actual header count that determines exploitability). Where possible, decrypted traffic inspection should be preferred.

• The attack requires approximately 11 minutes of sustained connection to accumulate sufficient header lines. Connection duration monitoring may serve as a supplementary detection heuristic.

Conclusion

This vulnerability was patched by Microsoft in the June 2026 release cycle. They note several mitigations that include editing the registry to ensure unpatched systems are not vulnerable to exploitation. However, the best method to ensure this bug has been fully remediated is to test and deploy the vendor-supplied patch.

Special thanks to Yazhi Wang and Jonathan Lein of the TrendAI Research team for providing such a thorough analysis of this vulnerability. For an overview of TrendAI Research services, please visit https://go.trendmicro.com/tis/vulnerabilities.html.

The threat research team will be back with other great vulnerability analysis reports in the future. Until then, follow the team on Twitter, Mastodon, LinkedIn, or Bluesky for the latest in exploit techniques and security patches.

The post Common Network Vulnerabilities and Threats — and How to Handle Them appeared first on Fidelis Security.

Read more →

The post PQC Migration Now Has a Deadline. Does Your DNS Estate? appeared first on IT Security News.

The post Vulnerability Scanning with OpenVAS 9 part 2: Vulnerability Scanning appeared first on Hacking Tutorials.

New users can save on the latest language-learning tech with a one-year subscription to Rosetta Stone Sapphire at a big discount.

(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

While app performance is often equated with a smooth UI and fast start times, memory serves as the silent foundation upon which these visible metrics are built. It's no secret that we're seeing a shift where device memory is more important than ever. Not only have we made strides in Android memory optimizations with Android 17, we're providing the tooling and API support to help you stay ahead of stricter memory requirements later this year.

To ensure device stability, starting in Android 17, the system will begin enforcing app memory limits based on the device's total RAM. If an app exceeds those limits, Android will kill the process with no associated stack trace.

Optimize image loading

Detect and fix memory leaks with Android Studio

Memory leaks in Android occur when your code holds onto an object's reference long after its lifecycle has ended. This prevents the Garbage Collector (GC) from reclaiming that memory, eventually leading to sluggish performance or OutOfMemoryError (OOM).

Android Studio Panda 3 features a dedicated LeakCanary profiler task, allowing developers to analyze real-time memory leaks and map traces within the IDE.

The LeakCanary profiler task in Android Studio actively moves the memory leak analysis from your device to your development machine, resulting in a significant performance boost during the leak analysis phase as compared to on-device leak analysis.

Additionally, the leak analysis is now contextualized within the IDE and fully integrated with your source code, providing features like go to declaration and other helpful code connections that drastically reduce the friction and time required to investigate and fix memory leaks.

Trim memory when app leaves visible state

Android can reclaim memory from your app or stop your app entirely if necessary to free up memory for critical tasks, as explained in Overview of memory management. Android will usually reclaim memory from your app when it’s not visible to the user, such as by discarding some of your app’s code and data pages in memory or compressing your heap allocations. When the user resumes your app and your app tries to access some memory that’s been reclaimed, the OS will swap that memory back in on demand. This swapping behavior can be slow, and cause unexpected jank or stutters in your app.

If you leave it to the OS to decide what memory to reclaim from your app, you may find that the OS reclaimed memory that you’ll need shortly after resuming your app. Instead, your app can voluntarily discard memory allocations that it can regenerate later, on demand and at a low cost. To do so, you can implement the ComponentCallbacks2 interface. You can implement onTrimMemory in your Activity, Fragment, Service, or even your custom Application class. Using it in the Application class is highly effective for global cache management.

The provided onTrimMemory() callback method notifies your app of lifecycle or memory-related events that present a good opportunity for your app to voluntarily reduce its memory usage.

In terms of memory lifecycle management, your implementation should focus exclusively on TRIM_MEMORY_UI_HIDDEN and TRIM_MEMORY_BACKGROUND. Since Android 14, the system has ceased delivering notifications for other legacy constants, which were formally deprecated in Android 15.

TRIM_MEMORY_UI_HIDDEN: This signal indicates that your application's UI has transitioned out of the user's view. This provides an opportunity to release substantial memory allocations tied strictly to the interface—such as Bitmaps, video playback buffers, or complex animation resources.

TRIM_MEMORY_BACKGROUND: At this level, your process is residing in the background and is now a candidate for termination to satisfy the system's global memory needs. To extend the duration your process remains in the cached state, and reduce the number of app cold starts, you should aggressively release any resources that can be easily reconstructed once the user resumes their session.

import android.content.ComponentCallbacks2
// Other import statements.

class MainActivity : AppCompatActivity(), ComponentCallbacks2 {

    /**
     * Release memory when the UI becomes hidden or when system resources become low.
     * @param level the memory-related event that is raised.
     */
    override fun onTrimMemory(level: Int) {

        if (level >= ComponentCallbacks2.TRIM_MEMORY_UI_HIDDEN) {
            // Release memory related to UI elements, such as bitmap caches.
        }

        if (level >= ComponentCallbacks2.TRIM_MEMORY_BACKGROUND) {
            // Release memory related to background processing, such as by
            // closing a database connection.
        }
    }
}

Note: The onTrimMemory integration may depend on SDK support. For instance, certain games rely on their game engine to enable this capability. Please check out the game memory optimization documents.

Advanced memory observability with ProfilingManager

To catch and diagnose memory issues in the field that cannot be reproduced locally, you should leverage the ProfilingManager API. Introduced in Android 15, this advanced observability API allows you to programmatically collect real-user Perfetto profiles.

For teams that lack a dedicated infrastructure to manage and host performance artifacts, Crashlytics is exploring a specialized solution to streamline this workflow. They are inviting developers to provide feedback.

Android 17 introduces new event-driven triggers, most notably TRIGGER_TYPE_OOM and TRIGGER_TYPE_ANOMALY:

• The OOM trigger automatically collects a Java heap dump at the exact moment an OutOfMemoryError crash occurs, providing precise allocation states. A collected OOM profile is provided the next time the app starts and registers the registerForAllProfilingResults callback.
• The Anomaly trigger detects severe performance issues, such as excessive binder spam or breached memory thresholds. The memory anomaly delivers a heap dump just prior to the system terminating the app.

  val profilingManager = 
applicationContext.getSystemService(ProfilingManager::class.java)
    val triggers = ArrayList()  


    triggers.add(ProfilingTrigger.Builder(
                 ProfilingTrigger.TRIGGER_TYPE_ANOMALY))
    val mainExecutor: Executor = Executors.newSingleThreadExecutor()
    val resultCallback = Consumer { profilingResult ->
        if (profilingResult.errorCode != ProfilingResult.ERROR_NONE) {
            // upload profile result to server for further analysis          
            setupProfileUploadWorker(profilingResult.resultFilePath)
        } 

    profilingManager.registerForAllProfilingResults(mainExecutor, resultCallback)
    profilingManager.addProfilingTriggers(triggers)

Once you’ve collected the heap dump, you can download the profile from the server, or locally via adb pull and drag and drop the file into the Perfetto UI. To streamline your memory debugging workflow, use the Heap Dump Explorer, this is the new default view for heap dumps in Perfetto UI. This tool provides an intuitive interface for inspecting Java heap dumps, allowing you to visualize object allocation hierarchies, compute retained memory sizes, and identify the shortest path from garbage collection root. By leveraging the Heap Dump Explorer, you can rapidly pinpoint memory leaks, bloated retained objects such as excessive bitmap allocations, and analyze heap object allocations all in one place.

Conclusion

Optimizing bytecode with R8, adopting image loading best practices, and resolving memory leaks are critical steps toward delivering a high-quality user experience while managing resources effectively under pressure. Adopting these proactive measures helps maintain app stability and performance, preventing unexpected terminations while safeguarding user context. To further your performance expertise, explore our revised memory guidance.

Today we're releasing Android 17 and making it available on most supported Pixel devices. Look for new devices running Android 17 in the coming months.

Android 17 marks the start of our transition to an intelligence system, putting your apps at the center. It's shifting to an adaptive-first development standard by introducing mandatory large-screen resizability, all while delivering next-generation privacy, security, media, camera, and performance. We'll cover all that in this post, as well as how we're bringing together next generation tools, libraries, and agent skills to help your apps embrace the opportunity.

Throughout the past year, from our Canary channel to our Beta releases, we’ve collaborated with you in the developer community to build a platform you and your users can trust. To that end, this moment marks the availability of the source code at the Android Open Source Project (AOSP). This allows you to examine the source code for a deeper understanding of how Android works.

Let's dive deeper into Android 17.

An intelligence system

With deep integration between hardware, software and AI, we’re transforming Android from an operating system to an intelligence system. It's about delivering new helpful experiences that anticipate user needs, and it brings more opportunities for engagement with your apps. To that end, Android 17 expands the capabilities of AppFunctions, a platform API with a corresponding Jetpack library. It allows you to contribute your app's unique capabilities as orchestratable "tools" for Android MCP, the on-device equivalent of the Model Context Protocol. AI agents and assistants (like Google Gemini) can discover and execute AppFunctions to perform workflows on behalf of the user with direct access to the app's local state.

The Jetpack library, currently in alpha, makes adding AppFunctions as easy as annotating a class and adding KDoc comments.

/**
 * A note app's [AppFunction]s.
 */
class NoteFunctions(
    private val noteRepository: NoteRepository
) {
    /**
     * Adds a new note to the app.
     *
     * @param appFunctionContext The execution context.
     * @param title The title of the note.
     * @param content The note's content.
     */
    @AppFunction(isDescribedByKDoc = true)
    suspend fun createNote(
        appFunctionContext: AppFunctionContext,
        title: String,
        content: String
    ): Note {
        return noteRepository.createNote(title, content)
    }
}

We’ve also launched an AppFunctions agent skill that analyzes your app’s key workflows, automatically generates the required Kotlin code, optimizes your KDocs for LLM tool-calling, and provides ADB commands for testing and debugging.

The Gemini integration is currently in a private preview with trusted testers, but you can begin preparing your apps now. In addition to ADB commands to execute your AppFunctions, we've provided a test agent app that includes an interface to discover and execute your app functions and simulate an AI agent integration. Join our integration early access program at goo.gle/eap-af for a chance to be among the first apps to deploy AppFunctions to production.

Adaptive-first

Your users no longer rely on a single form factor; they transition between phones, foldables, tablets, laptops, automotive displays, and immersive XR environments. Now, with over 580 million large screen devices in the hands of users and the forthcoming launch of Googlebooks, the next generation of ChromeOS built on the Android stack, adaptive is no longer just a technical goal. It’s a massive opportunity to reach highly engaged users, which is one of the reasons we're shifting to an adaptive-first development standard.

No resizability/orientation restrictions on large screens

To ensure apps deliver a premium experience across all form factors, including mobile devices running in desktop mode on connected displays, Android 17 (API level 37) removes the developer opt-out for orientation and resizability restrictions on large screen devices (sw > 600 dp) for apps targeting API level 37. The system will ignore legacy manifest attributes and runtime APIs, including screenOrientation, setRequestedOrientation(), resizeableActivity=false, and aspect ratio constraints (minAspectRatio/maxAspectRatio). Games (based on app category in Google Play) remain exempt. Your app must be ready to adapt to any window size, respect the user's preferred device posture, and support free-form windowing natively.

Next-gen multitasking: App Bubbles, Bubble Bar, and desktop interactive PiP

Android 17 introduces powerful new windowing capabilities that redefine how users multitask, demanding even greater layout flexibility from your apps:

• App Bubbles: Moving beyond the messaging bubbles API, users can now transform any app into a floating bubble by long-pressing its icon on the launcher. This feature is available across phones, foldables, and tablets, enabling lightweight multitasking for any workflow.
• The Bubble Bar: On large screens (tablets and foldables), the system taskbar now includes a dedicated Bubble Bar to organize, transition between, and dock these floating app bubbles.
• Desktop interactive PiP: In desktop environments, Android 17 introduces interactive Picture-in-Picture (PiP). Unlike traditional PiP windows which are read-only, these pinned windows remain fully interactive while staying always-on-top of other application windows.

App Bubbles and Bubble Bar in action

Activity recreation updates

To prevent disruptive state loss and stutter, Android 17 updates the default behavior for Activity recreation. The system will no longer restart activities by default for typical configuration changes that do not require a full UI redraw (including CONFIG_KEYBOARD, CONFIG_KEYBOARD_HIDDEN, CONFIG_NAVIGATION, CONFIG_TOUCHSCREEN, and CONFIG_COLOR_MODE).
Instead, running activities will receive these updates via onConfigurationChanged(), enabling smooth transitions. If your application explicitly relies on a full restart to reload resources for these changes, you must now explicitly opt-in using the new android:recreateOnConfigChanges manifest attribute.

Continue On

Android 17 adds Continue On to help users seamlessly transition a task between Android devices. The user sees a suggestion for the most recently opened app from their mobile device in their tablet taskbar, providing a one-tap affordance to launch the app and deep-link where they left off. Continue on can support app-to-web transitions, including falling back to using the web if the app isn't installed.

Handoff Suggestion on a Tablet

class MyHandoffActivity : Activity() {

    ...

  override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)
    // Do stuff
    ...
    // Enable handoff
    setHandoffEnabled(true, null)
  }

  // Override and implement onHandoffActivityDataRequested
  override fun onHandoffActivityDataRequested(handoffRequestInfo: HandoffActivityDataRequestInfo) : HandoffActivityData {
    // Create and return handoff data
  }
}

Go adaptive-first with Jetpack Compose

To help you adapt your apps to meet the new Android 17 requirements, we've launched the Jetpack Compose adaptive skill. This AI-powered developer workflow helps you implement the best adaptive practices:

• Adaptive navigation: Automatically transition between bottom navigation bars on mobile and edge-anchored navigation rails on large screens using NavigationSuiteScaffold from the Material 3 Adaptive library.
• Multi-pane layouts: Implement list-detail and supporting pane layouts natively using Navigation 3 Scenes (ListDetailSceneStrategy and SupportingPaneSceneStrategy) instead of fragile fragment transactions.
• FlexBox & Grid APIs: Utilize Compose 1.11's dynamic layout components to easily adjust row and column spans on the fly, ensuring your content always fills the space beautifully.
• Advanced non-touch input: Leverage Compose 1.11's enhanced trackpad and mouse support, including native focus rings and new APIs (like TrackpadInjectionScope and performTrackpadInput) to easily test and deliver a true "laptop-class" experience on Googlebooks and Desktop Mode.
• Dynamic window states: Leverage Compose's reactive state model to seamlessly adapt your UI when the app transitions from full screen to a floating App Bubble or an interactive Desktop PiP window, ensuring a premium experience even at minimal dimensions.

Android is Compose-first

Compose offers the easiest way to build adaptive apps, and that's just one of the many reasons we believe that all Android UI should be built with Compose. To that end, Android development is now Compose-first. All new Android APIs, libraries, tools, and developer guidance will be built exclusively for Jetpack Compose. Legacy View components (in the android.widget package) and View-based Jetpack libraries (like Fragments, RecyclerView, and ViewPager) are now in maintenance mode. They will receive only critical bug fixes, and no new features.

TIP
Ready to migrate? Use our AI-driven XML to Compose Migration Skill to automatically analyze your legacy View layouts and convert them into highly-adaptive Compose code.

Performance & efficiency

App performance means a smooth user interface, fast app start times, and efficient multitasking; Android 17 has impactful improvements in all of these areas.

App memory limits

Memory usage is one of the silent foundations of overall performance. When a foreground app or service grows unchecked, memory management spikes CPU and battery utilization and eventually leads to the termination of other well-behaved cached apps and background jobs, ultimately forcing slower cold starts and impaired multitasking. 

Starting in Android 17, the system will enforce strict app memory limits based on a device's total RAM, abruptly terminating offending processes. New things to help you navigate these tighter requirements:

• R8 Optimizer: The R8 optimizer significantly reduces your app's bytecode memory footprint by shrinking classes, methods, and fields into shorter names, and stripping out unused code and resources. Use R8 in full mode along with the new R8 configuration analyzer to make sure your app is getting the most from R8.
  

• LeakCanary in Android Studio Panda: The profiler now features native LeakCanary integration as a dedicated task, fully integrated with your IDE and source code.
• ApplicationExitInfo: If your app is terminated by these limits, getDescription() from ApplicationExitInfo will return "MemoryLimiter:AnonSwap".
• On-Device Anomaly Detection: Part of ProfilingManager, you can leverage trigger-based profiling using TRIGGER_TYPE_ANOMALY to automatically capture heap dumps when the memory limit is reached.

val profilingManager = applicationContext
   .getSystemService(ProfilingManager::class.java)

val triggers = ArrayList<ProfilingTrigger>().apply {
  add(ProfilingTrigger.Builder(
    ProfilingTrigger.TRIGGER_TYPE_ANOMALY).build())
}
profilingManager.addProfilingTriggers(triggers)

And, we're working to surface more in-field memory metrics to you within Google Play Console.

Generational garbage collection

Android 17 introduces more frequent, less resource-intensive young-generation collections to ART's Concurrent Mark-Compact garbage collector (GC). By separating short-lived objects from stable, long-lived ones, the system runs frequent, lightweight "young-generation" sweeps rather than expensive full-heap scans, drastically reducing CPU usage, power drain, and UI stutter. Our testing has shown significant improvements in GC interference with application threads and a reduction in the maximum memory resident set size (RSS). ART improvements are also available to over a billion devices running Android 12 (API level 31) and higher through Google Play System updates.

Lock-Free MessageQueue

For apps targeting SDK 37 or higher, the core android.os.MessageQueue now implements a lock-free architecture, significantly reducing missed frames, improving app startup time, and radically improving the performance of busy queues in multithreaded scenarios. Note: This can break apps that use reflection on private MessageQueue fields and methods.  The peekWhen and poll APIs have been added to TestLooperManager for instrumentation testing without relying on MessageQueue internals.

Static final fields now truly final

Starting from Android 17, apps targeting SDK 37 or higher won’t be able to modify “static final” fields, allowing the runtime to apply performance optimizations more aggressively. An attempt to do so via reflection (or deep reflection) will lead to an IllegalAccessException being thrown. Modifying them via JNI’s SetStatic<Type>Field methods family will immediately crash the application.

Custom notification view restrictions

To reduce memory usage we are further restricting the size of custom notification views. This update closes a loophole that allows apps to bypass existing limits using URIs. This behavior is gated by the target SDK version and takes effect for apps targeting API 37 and higher.

Privacy & Security

Maintaining user trust is at the heart of the Android ecosystem. Android 17 introduces robust features that protect sensitive data while simplifying user experiences.

Privacy-preserving choices

Historically, apps required broad, permanent permissions to access information like contacts, precise location and media files. Android 17 continues the shift toward privacy-preserving choices that grant temporary, session-based access only to the data the user explicitly selects:

• System-Level Contact Picker: Utilizing ACTION_PICK_CONTACTS, apps can request temporary access only to specific fields (e.g., email or phone number) chosen by the user, eliminating the need for the broad READ_CONTACTS permission. It also fully supports work/personal profile separation.
• Customizable Photo Picker aspect ratio: UsingPhotoPickerUiCustomizationParams, you can customize the system photo picker to show thumbnails in portrait mode. This is perfect for apps that always display photos and videos in portrait such as video based social media apps.
• System-rendered Location Button: A new system-rendered location button that you can embed in your app grants precise location access for the current session only.
• EyeDropper API: A new system-level API, ACTION_OPEN_EYE_DROPPER, allows your app to create a system-powered eyedropper enabling the user to select color from any pixel on the display. This provides a secure, privacy-preserving color-picking experience that eliminates the need for broad, sensitive screen capture or media projection permissions.

val eyeDropperLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
   if (result.resultCode == Activity.RESULT_OK) {
       val color = result.data?.getIntExtra(Intent.EXTRA_COLOR, Color.BLACK)
       // Use the picked color in your app
   }
}
fun launchColorPicker() {
   val intent = Intent(Intent.ACTION_OPEN_EYE_DROPPER)
   eyeDropperLauncher.launch(intent)
}

Picking a color from anywhere on the screen with the system EyeDropper

Local network access

Apps targeting Android 17 now either require the ACCESS_LOCAL_NETWORK runtime permission or the use of system-mediated, privacy-preserving device pickers for local network communication, such as talking to smart home devices or casting receivers. Because ACCESS_LOCAL_NETWORK falls under the existing NEARBY_DEVICES permission group, users who have already granted other NEARBY_DEVICES permissions will not be prompted again.

SMS OTP protection

Android 17 expands SMS one-time-password (OTP) protection by delaying access to SMS messages for three hours:

• WebOTP Format: Delayed for all apps that are not the intended recipient (domain mismatch).
• Standard SMS OTP: Delayed for all apps targeting SDK 37+.
• Exemptions: Default SMS, assistant, and connected companion apps are exempt. Apps are strongly encouraged to migrate to the SMS Retriever or SMS User Consent APIs.

Post-Quantum Cryptography (PQC)

Android 17 is ready for the next generation of cryptographic security:

• Keystore Integration: Supported devices can generate ML-DSA (Module-Lattice-Based Digital Signature Algorithm) keys in secure hardware to produce quantum-safe signatures, exposed via standard JCA APIs.
• Hybrid APK Signing: Introducing the v3.2 APK Signature Scheme, which combines classical signatures with ML-DSA signatures to secure app delivery.

Safer native dynamic code loading 

Smarter password protection for physical inputs

With Android 17, we're making it safer to enter passwords, PINs, and other secrets when using a physical keyboard by no longer showing the last typed character by default.

Users can still easily customize these display settings to match their preferences (availability may vary by device manufacturer).

These enhanced privacy protections are automatically supported byAndroid's built-in SDK components and will be supported in Compose 1.12 for SecureTextFields.

Media and camera features that empower creators and delight users

Android 17 introduces new creator features that give access to pro-quality cameras and media, all while improving the experience for consumers.

• Eclipsa Video: HDR video standard built upon the SMPTE ST 2094-50 specification that introduces new metadata to help devices adapt content for their display headroom and ambient light conditions, as well as improve the simultaneous display of standard and HDR content.
• RAW14 image format: New support for the RAW14 image format provides a way for your professional camera app to capture the highest level of detail and color depth from compatible camera sensors.
• Vendor-defined camera extensions: Vendor-defined extensions enable hardware partners to define and implement custom camera extension modes, providing access to the best and latest camera features.
• Extended HE-AAC software encoder: A new system-provided Extended HE-AAC software encoder, supports both low and high bitrates using unified speech and audio coding, providing significantly better audio quality for voice messages in low-bandwidth conditions, including support for loudness metadata.
• Versatile Video Coding (H.266): Enables OEMs to add codec support by defining the video/vvc MIME type in MediaFormat, adding new VVC profiles in MediaCodecInfo, and integrating support into MediaExtractor.
• Camera device type: New APIs that query the underlying device type to identify if a camera is built-in hardware, an external USB webcam, or a virtual camera.
• Constant Quality for Video Recording: SetVideoEncodingQuality in MediaRecorder configures a constant quality (CQ) mode for video encoders to ensure uniform visual fidelity across the entire video.

Better support for hearing aids

• Bluetooth LE Audio hearing aid support: Android now includes a specific device category for Bluetooth Low Energy (BLE) Audio hearing aids with the new AudioDeviceInfo.TYPE_BLE_HEARING_AID constant, so your app can distinguish hearing aids from regular headsets to provide a tailored experience for users with assistive listening devices.
• Granular audio routing for hearing aids: Android 17 allows users to independently manage where specific system sounds are played. They can choose to route notifications, ringtones, and alarms to connected hearing aids or the device's built-in speaker, helping to avoid unwanted in-ear interruptions while maintaining a Bluetooth connection for hearing aid management apps.

CameraX and Media3

CameraX and Media3 have been updated for Android 17. They are there to do the heavy lifting, smoothing the rough edges of media development and simplifying building reliable camera capture, smooth media playback, and creative and complex editing experiences.

We've released an agent skill that can migrate legacy Android camera implementations (Camera1 or raw Camera2 APIs) to CameraX.

Note: You'll need to update your CameraX version to either 1.5.2 or 1.6.0+ to avoid a crash related to an added dynamic range mode on Android 17 devices.

Get your apps, libraries, tools, and game engines ready!

If you develop an Android SDK, library, tool, or game engine, it's critical to prepare any necessary updates now to prevent your downstream app and game developers from being blocked by compatibility issues and allow them to target the latest SDK features. Please let your downstream developers know if updates are needed to fully support Android 17.

Testing involves installing your production app or a test app making use of your library or engine using Google Play or other means onto a device or emulator running Android 17 Beta 4. Work through all your app's flows and look for functional or UI issues. Each release of Android contains platform changes that improve privacy, security, and overall user experience; review the app impacting behavior changes for apps running on and targeting Android 17 to focus your testing, including the following:

• Resizability on large screens: Once you target Android 17 (SDK 37), you can no longer opt out of maintaining orientation, resizability and aspect ratio constraints on large screens.
• Dynamic code loading: If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection introduced in Android 14 for DEX and JAR files now extends to native libraries. All native files loaded using System.load() must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError.
• Enable CT by default: Certificate transparency (CT) is enabled by default. (On Android 16, CT is available but apps had to opt in.)
• Local network protections: Apps targeting SDK 37 or higher have local network access blocked by default. Switch to using privacy preserving pickers if possible, and use the new ACCESS_LOCAL_NETWORKpermission for broad, persistent access.
• Background audio hardening: Starting in Android 17, the audio framework enforces restrictions on background audio interactions including audio playback, audio focus requests, and volume change APIs. Based on your feedback, we’ve made some changes since beta 2, including targetSDK gating while-in-use FGS enforcement and exempting alarm audio. Full details available in the updated guidance.
• NPU access declaration: Apps targeting Android 17 that need to directly access the NPU must declare FEATURE_NEURAL_PROCESSING_UNIT in their manifest to avoid being blocked from accessing the NPU. This includes apps that use the LiteRT NPU delegate, vendor-specific SDKs, as well as the deprecated NNAPI.

Get started with Android 17

Your Pixel device should get Android 17 shortly if you haven't already been on the Android Beta. If you don’t have a Pixel device, you can use the 64-bit system images with the Android Emulator in Android Studio. If you are currently on Android 17 Beta 4.1 and have not yet taken an Android 17 QPR1 beta, you can opt out of the program and you will then be offered the release version of Android 17 over the air.

Getting the Android 17 beta on partner devices

Android 17 is available in beta on handset, tablet, and foldable form factors from partners including Honor, iQOO, Lenovo, OnePlus, OPPO, Realme, Sharp, vivo, and Xiaomi.

For the best development experience with Android 17, we recommend that you use the latest Canary build of Android Studio Quail. Once you’re set up, here are some of the things you should do:

Test your current app for compatibility, learn whether your app is affected by changes in Android 17, and install your app onto a device or Android Emulator running Android 17 and extensively test it.

Thank you again to everyone who participated in our Android developer preview and beta program. We're looking forward to seeing how your apps take advantage of the updates in Android 17, and have plans to bring you updates in a fast-paced release cadence going forward.

For complete information on Android 17 please visit the Android 17 developer site.

Posted by Paul Feng, Vice President, Google Play Eng, Product, UX

More billing flexibility

Lower, separate fees

 

• New installs: A transaction from a user whose first-time install or first update of the app from Google Play occurred on or after the date that the new fee structure launched in their region.
• Existing installs: A transaction from a user whose first-time install or first update of the app from Google Play occurred before the date that the new fee structure launches in their market.

For transactions that use Google Play’s billing system, an additional billing fee applies. In the United States, United Kingdom, and the European Economic Area, the billing fee is set at 5%. We'll announce billing fee details for other markets soon. For transactions processed via alternative billing or external web links, the billing fee does not apply.

Review this Help Center article to understand how these rates apply to your business.

Games Level Up and Apps Experience program guidelines

We are also excited to announce even more opportunities for partners who deliver exceptional user experiences across the Android ecosystem: the revamped Games Level Up and the new Apps Experience program. Detailed guidelines are now available on the respective program websites.

Apps and games that meet all requirements are eligible for a new program rate card with reduced rates. See the table below for details:

Visit the Games Level Up and Apps Experience program websites, review the guidelines, and start preparing your games and apps ahead of September 30, 2026, when the program rate cards officially become available.

Global release schedule

Evolving our business model requires technical infrastructure and alignment with local regulations, so these updates will roll out on a staggered timeline. To help you plan, here is the previously announced release schedule for each update across all markets:

Here is a quick recap of the resources available to help you get started:

• Review the billing choice program;
• Learn more about Google Play's lower service fees;
• Explore detailed guidelines on the Games Level Up and Apps Experience program websites.

We look forward to building the next generation of Google Play experiences together.

We’ve all been there: You’re scrolling through your favorite social media feed in a dim room, and suddenly an HDR video pops up. It’s so intensely bright that you have to squint, or maybe you find yourself turning down your screen brightness just to read the caption. Other times, a video that looks vibrant on your phone looks flat, dark, or washed out when you watch it on your living room TV. 

While High Dynamic Range (HDR) technology was designed to make videos look richer and more lifelike, the lack of unified industry guidelines means that the exact same clip can render in unexpected and jarring ways depending on the display you’re using.

To solve this, we’re introducing Eclipsa Video—a new standard built to make your favorite videos look consistent, balanced, and comfortable on every screen. Eclipsa Video builds on the open SMPTE ST 2094-50 specification, which Google developed in collaboration with Apple and NBCUniversal.

Sudden brightness spikes during feed scrolling—fixed with Eclipsa Video.

More consistency, comfort, and creative control

Designed to scale with your hardware, Eclipsa Video provides three core benefits:

• A consistent baseline: Eclipsa Video introduces a shared rulebook for screens. It establishes a consistent benchmark for normal brightness—known as the HDR reference white. This ensures standard text, app interfaces, and standard-range colors remain vibrant and readable without causing uncomfortable screen glare.
• Adaptive headroom: Screens have different physical brightness limits, or "headroom." Eclipsa Video guides how displays handle highlights dynamically. Bright details remain brilliant on a premium television, while being scaled intelligently on a mobile screen to prevent sudden blinding transitions.
• Preserved creative intent: Rather than applying a single static setting to an entire video, Eclipsa Video carries adaptive, frame-by-frame instructions. Think of it as a set of digital notes from the creator traveling with the video, ensuring the exact colors, contrast, and mood they graded are preserved on your display.

Eclipsa Video preserves true highlight detail on any screen you watch.

Built natively into Android 17

Starting with Android 17, support for Eclipsa Video is built directly into the platform. This means a more comfortable, true-to-life HDR experience is coming natively to the phones, tablets, and TVs you rely on every day. The video you capture carries its creative intent with it, and the video you watch is shown exactly the way it was meant to be seen.

Guidelines for developers & creators

We’re inviting the developer and creator ecosystem to help build a more reliable HDR environment:

• Get started with implementation: Learn how to configure playback and capture in your apps with our official guide.
• ExoPlayer & Media3 integration: Standard playback handling built directly into Jetpack Media3, allowing ExoPlayer to support Eclipsa Video metadata automatically with no additional player configuration.
• Explore open source tools: View and inspect SMPTE ST 2094-50 metadata and dynamic gain curves in real time using HDR Explorer.

What’s next

Eclipsa Video is rolling out now, and you’ll see more apps and devices supporting it over time. Because it’s an open standard, any app developer or hardware manufacturer can integrate it to elevate the viewing experience.

Try out the new tools in Android 17, explore the open-source metadata, and let us know what you think on our developer channels. We can’t wait to see what you create.

Notes & Availability

1. Device Compatibility: Eclipsa Video playback and capture are supported natively on devices running Android 17 (API level 37) and above with HDR displays passing Eclipsa Compliance tests.

2. Developer Resources: The SMPTE ST 2094-50 Specification is openly accessible for technical evaluation.

Posted by Amman Asfaw, Product Manager, Android Studio

Android Studio Quail 2 is now stable and ready for you to use in production, bringing a shift to your IDE with concurrent agentic workflows, natively integrated memory leak profiling, and context-aware crash remediation. Whether you are performing a sweeping architectural overhaul, tracing a memory leak, or resolving a critical production crash, Android Studio keeps you anchored in your workspace by reducing manual friction.

Here’s a deep dive into what’s new:

Multi-tasking with parallel chats

In Android Studio Quail 2, we've been hard at work redesigning Agent Mode from the ground up. This new architecture provides better performance, offers more flexibility for decomposing complex tasks, and improves the suite of internal tools the agent uses to do its work.

• How to use: Click the "+" icon to start a new parallel conversation, and use the History icon to navigate between active tasks. Alternatively, select File > New > New Agent Tab to open a conversation in a dedicated tab.
• Note: Worktree support is currently unavailable. Exercise caution when running concurrent chats that modify the same project files, which can potentially lead to editor conflicts.

Run multiple agent tasks in parallel with different models of your choice.

Memory leak detection with LeakCanary

Memory leaks in Android occur when your code holds onto an object's reference long after its life cycle has ended. This prevents the Garbage Collector from reclaiming that memory, eventually leading to sluggish performance or OutOfMemoryError.

Hunting down memory leaks can be a tedious, manual task. Starting with Android Studio Quail 2, the popular open-source leak detector LeakCanary is natively integrated directly into the Profiler as a dedicated, first-class task.

This integration transforms your debugging performance by lifting and shifting the heap analysis off your resource-constrained testing phone, and onto your powerful development computer. By running the analysis on your computer, leak tracing is up to five times faster and jank-free, leaving your test app running smoothly on the device.

Once a leak is detected during a profiling session:

• The Profiler renders an interactive, color-coded leak trace, grouping occurrences and estimating lost memory.
• You can click Go to declaration on any leaking object in the trace to instantly jump to that exact line of code in your editor.
• You can click Fix with Agent to have the Gemini agent ingest the trace, explain the root cause of the retained reference, and write the exact code change (such as unbinding a listener or clearing a static reference) to plug the leak.

Review memory leaks identified via LeakCanary through the Fix with Agent button.

App Quality Insights agent integration

Tracking down the root cause of an app crash can require manually synthesizing stack traces, device data, and source code. However Android Studio’s App Quality Insights (AQI) is now fully integrated with Agent Mode to do the heavy lifting for you.

When you click on a crash in the AQI panel, you immediately get a concise, high-level summary of the issue. If you need to dig deeper, simply click See more. This opens a dedicated chat where the agent uses your selected model and pulls in local source code and the full stack trace to deliver a comprehensive explanation of the failure.

With the new agent integration, you move directly from issue identification to resolution. By clicking Fix with AI, the agent will analyze the issue, propose a step-by-step fix plan, and—upon your approval—apply the necessary code changes directly to your project and verify the resulting fix

The Fix with AI button triggering the agent to analyze the issue, then propose the fix

Quality & stability improvements

Beyond new features, we’ve continued our focus on quality by addressing numerous bugs and incorporating the latest stability and performance improvements from the IntelliJ platform, making this a significant enhancement for your daily development.

Get Started

Ready to dive in and accelerate your development? Download Android Studio Quail 2 and start exploring these new features today! As always, your feedback is crucial to us. Check known issues, report bugs, and be part of our vibrant community on LinkedIn, Medium, YouTube, or X. 

Posted by Ben Weiss, Senior Developer Relations Engineer, Android Developer Relations

Welcome back to the blog post series "Build intelligent Android apps" where we take a basic Android app and transform it into a personalized, intelligent, and agentic experience. In our previous post, we explored how to leverage Firebase AI Logic to build cloud-hosted and hybrid AI features.

In this article, we'll show you how we designed and integrated these capabilities into our travel planning app, JetPacker, using Android AppFunctions. We'll explore the rationale behind our feature choices, discuss the specialized tooling we used to accelerate development, and dive into the code that makes it all work.

Designing AI-ready features: making choices that matter for your users

To select which features to provide to the intelligence system, we looked for tasks where a voice or text command is objectively faster than tapping through screens. In this side-by-side screen recording you can see this contrast perfectly: on the left, a user tapping through multiple screens to log an expense; on the right, the same task completed instantly in the background via a privileged agent.

Our first choice was expense tracking. Logging a coffee expense during a trip usually takes quite a few taps—unlocking the phone, opening the app, finding the active trip, navigating to the expenses tab, tapping the add button, taking a picture of the receipt, and checking the result. By providing the addExpense and getExpenses features as AppFunctions, the system agent handles the heavy lifting. When the user says, "Add a five-dollar coffee expense to my Paris trip," the agent automatically searches for the correct trip ID in the background and inserts the expense, skipping the manual UI flow entirely.

We also prioritized itinerary management. Finding what activity is next on a busy trip itinerary usually requires scrolling through a dense timeline view. By providing getItinerary and addItineraryEvent to the system, the user can simply ask, "What am I doing next in Paris?" and get an immediate answer.

Finally, we focused on hands-free note capturing. Typing out reminders or notes while walking down a busy street is difficult and unsafe. Exposing a voice note capability allows the user to say, "The flight was amazing, I saw a beautiful sunset and managed to sleep well," and the privileged agent automatically transcribes and saves it directly into the travel database  using the addVoiceNote AppFunction.

Android MCP powered by AppFunctions

This entire experience is built on Android MCP. Under this design, the app acts as a local MCP server. Rather than remote APIs, you provide your app features directly to the on-device intelligence system.

Android AppFunctions is the API that brings this concept to life. It reads annotated Kotlin functions and compiles them into type-safe, sandboxed tool definitions that the privileged agent can discover and invoke locally on the device.

Diagram highlighting our apps, the android platform, and system agents coordinate AppFunctions.

Under the Android MCP model, your app acts as a local MCP server that exposes structured tools, while the Android platform serves as the central tool registry. On the MCP client side, agent apps are registered with the intelligence system after being granted system-privileged permissions to access the registry.

When a user interacts with a registered agent, its LLM determines if the request can be handled by an AppFunction, queries the platform's metadata, and executes the appropriate registered functions in the background. This local MCP client-server design gives you full control: you choose exactly which features are accessible to the agent, keeping the rest of your app's data private.

How we accelerated development with Android skills

To streamline the integration process, we leveraged the AppFunctions development skill. The AppFunctions development skill is a complete development companion. It guided us through the entire lifecycle: mapping Kotlin data classes to serialize parameters, generating the necessary Service entry points, refining our KDoc documentation to ensure the LLM understands parameter boundaries, and setting up automated testing using ADB.

Providing app features to the intelligence system

Enough with the theory, let's dive into the implementation.

Configuration and dependency setup

We begin by adding the AppFunctions dependencies. One for the API and one for the Kotlin Symbol Processing compiler.

implementation("androidx.appfunctions:appfunctions:1.0.0-alpha10")
ksp("androidx.appfunctions:appfunctions-compiler:1.0.0-alpha10")

Modeling custom data types

Any custom object exchanged with the agent must be annotated with @AppFunctionSerializable. In our TripSerializable.kt file, we define our trip data model:

@AppFunctionSerializable(isDescribedByKDoc = true)
data class TripSerializable(
    /** The trip's unique identifier. */
    val id: String,
    /** The trip's title. */
    val title: String,
    /** The trip's destination location. */
    val location: String,
    /** The trip's start date in milliseconds. */
    val startDate: Long,
    /** The trip's end date in milliseconds. */
    val endDate: Long,
    /** A list of participants. */
    val participants: List<String>,
)

Providing features using the @AppFunction annotation

Next, the skill wrote the Kotlin functions that perform the database queries and annotate them with @AppFunction. We can view this in searchTrip:

/**
 * Looks for trips based on optional filters like id, title (name), location, and dates.
 *
 * @param id The unique identifier of the trip.
 * @param title The title or name of the trip.
 * @param location The destination location.
 * @param startDate The minimum start date in milliseconds.
 * @param endDate The maximum end date in milliseconds.
 * @return A list of trips matching the filters.
 */
@AppFunction(isDescribedByKDoc = true)
suspend fun searchTrip(
    id: String? = null,
    title: String? = null,
    location: String? = null,
    startDate: Long? = null,
    endDate: Long? = null
): List<TripSerializable> {
    return withContext(Dispatchers.IO) {
    // implementation
}

Since AppFunctions run on the UI thread by default, we use withContext(Dispatchers.IO) to switch to a background dispatcher. Additionally, we refine our KDoc to use clear, imperative verbs and specify parameter constraints. This documentation compiles directly into the tool's schema, which the privileged agent uses to resolve parameters and handle runtime errors.

The service entry point and Hilt integration

To register these features with the intelligence system, we create an abstract base class that extends AppFunctionService. We annotate it with @AppFunctionServiceEntryPoint:

@RequiresApi(36)
@AndroidEntryPoint
@AppFunctionServiceEntryPoint(
    serviceName = "JetPackerAppFunctionService",
    appFunctionXmlFileName = "jetpacker_app_function_service"
)
abstract class BaseJetPackerAppFunctionService : AppFunctionService() {
    @Inject internal lateinit var tripDao: TripDao
    // DAOs and database references are injected here...
}

During compilation, KSP generates the final concrete service subclass, JetPackerAppFunctionService, as declared with the serviceName parameter. We also register app_metadata.xml in the app's manifest. This file provides global operational rules for JetPacker's declared AppFunctions.

Testing and verifying your AppFunctions

Once implemented, you should verify that your AppFunctions are registered and working correctly.

Running devices or emulators with Android 17 or newer, you can use ADB commands from your terminal to list and invoke your functions. Running adb shell cmd app_function list-app-functions displays all registered functions for your package. You can then execute a specific function and test its database integration by running adb shell cmd app_function execute-app-function while passing a raw JSON parameters string.

Instead of these ADB commands, you can also use the AppFunctions Testing Agent to inspect your configuration, list and execute AppFunctions, and even see how your AppFunctions behave in a real conversational flow.

Wrapping it up

When thinking about app features that can be contributed to the intelligence system using AppFunctions requires a slight shift in how we think about code and documentation. AppFunctions enable you to use this new interaction model for apps, which allows using an agent to access app features..

First, the AppFunctions development skill is an essential lifecycle tool, helping you discover features, implement and refine AppFunctions for your apps. Second, KDoc comments are a compiled API asset; clear parameter descriptions directly impact the execution accuracy of the system agent. Finally, Android MCP provides local-first execution allowing apps to safely collaborate with AI agents.

Contributing app features through AppFunctions makes your application ready for the intelligence system. Let us know how you are adapting your apps for the agentic era!

Learn more

Check out the other parts of this blog post series:
Part 1: Introduction of the app and a high-level overview.
Part 2: On-device intelligence. Deep-dive into ML Kit’s GenAI APIs and Gemini Nano to build privacy-first features like itinerary summarization, receipt parsing, and local audio processing.
Part 3: Hybrid and cloud reasoning. Explore how to use Firebase AI Logic to ground LLM answers in real-world data like Google Maps and web context.
Part 4 (this post!): System integration. Integrating with the Android intelligence system using AppFunctions.
Part 5 (coming soon): In-app agentic workflows. Extend the app with an end-to-end booking assistant powered by A2UI and ADK.

Interested in more on Android Development? Follow Android Developers on YouTube or LinkedIn!

All code snippets in this blog post follow the following copyright notice:

Copyright 2026 Google LLC.
SPDX-License-Identifier: Apache-2.0

Welcome back to the blog post series "Build intelligent Android apps" where we take a basic Android app and transform it into a personalized, intelligent, and agentic experience. In our previous post we explored how to build intelligent on-device features using Gemini Nano through ML Kit's Prompt API.

In this post, we will look at how you can leverage Firebase AI Logic to build cloud-hosted and hybrid AI features: 

• Grounding answers in real-world context
• Routing requests dynamically between cloud and local execution using hybrid inference
• Translating content with custom routing systems

Sometimes a use case requires AI models with greater world knowledge, a much larger context window, or the ability to handle complex queries. In those scenarios, we can leverage cloud models. 

Other times, you want the best of both worlds: using hybrid inference to run on-device when available to lower costs, while falling back to the cloud to ensure compatibility for all devices.

Cloud and hybrid features in Jetpacker: Museum assistant with web grounding, hybrid restaurant review drafting, and  support chat featuring custom-routed live translation.

Let’s look at how we implemented three cloud and hybrid features in Jetpacker:

• a museum assistant with web grounding
• hybrid restaurant review drafting
• hotel support chat featuring custom-routed live translation.

Use LLM grounding for up-to-date informationMuseum assistant chatbot with LLM grounding

The Museum assistant is an interactive chatbot designed to help users plan their museum visits. It provides visitors with up-to-date details regarding specific exhibits, current opening hours, ticket pricing, and more.

Museum assistant is a chatbot that answers questions, such as 

When building AI features, getting the model to answer with fresh, accurate, and specific real-world information is a common challenge. While cloud models possess massive amounts of world knowledge, they might not know about seasonal exhibits or the current day’s opening hours. 

Grounding data is added to the context window to enable the model

To bridge this gap, we can use grounding techniques to add extra context to the model’s context window. The Firebase AI Logic SDK supports three types of grounding:

• URL grounding: Grounding responses using content from a specific webpage (e.g. current ticket prices or museum rules).
• Google Search grounding: Letting the model query the real-time Google search index for up-to-date details.
• Maps grounding: Using Google Maps location data.

In Jetpacker, we dynamically construct the available tools based on enabled feature flags and initialize the generative model using the Firebase AI SDK:

// implementation("com.google.firebase:firebase-ai-logic")

private var toolList = mutableListOf<Tool>()

init {
    if (ENABLE_SEARCH_GROUNDING) {
        toolList.add(Tool.googleSearch())
    }
    if (ENABLE_URL_GROUNDING) {
        toolList.add(Tool.urlContext())
    }
}

private val generativeModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash",
        systemInstruction = content {
            text("You are a helpful museum assistant answering questions about a museum. Use plain text.")
        },
        tools = toolList
    )

When the user queries the assistant, if URL grounding is enabled, we append the specific museum resource URLs directly into the prompt:

val groundingText = if (FeatureFlags.ENABLE_URL_GROUNDING) {
    "\n If the following message above is about the rules and terms to visit Le Louvre, " +
    "if needed answer this urls ${urlList.joinToString()}"
} else {
    ""
}

val prompt = "$text $groundingText"

var response = chat.sendMessage(prompt)

Hybrid inference: On-device review generation with Maps deep link

Not every AI task requires a cloud-based model, and not every device is online. To help developers balance latency, cost, and offline availability, we recently introduced the Firebase API for Hybrid Inference.

In Jetpacker, the restaurant review feature lets users review select topics and automatically drafts a review. To enable this for all users, we prioritize local execution with Gemini Nano, and fall back to cloud models on devices that don’t support Gemini Nano. 

// implementation("com.google.firebase:firebase-ai-logic")
// implementation("com.google.firebase:firebase-ai-ondevice:16.0.0-beta03")


// Initialize the model with hybrid routing configuration
val reviewModel = Firebase.ai.generativeModel(
    modelName = "gemini-3.1-flash-lite",
    onDeviceConfig = OnDeviceConfig(
        inferenceMode = InferenceMode.PREFER_ON_DEVICE
    )
)

The Hybrid Inference API supports four distinct routing modes:

• PREFER_ON_DEVICE: Prioritizes local execution and falls back to cloud if Gemini Nano is unavailable.
• PREFER_IN_CLOUD: Prioritizes cloud execution and falls back to on-device if the device goes offline.
• ONLY_ON_DEVICE: Restricts execution strictly to the device.
• ONLY_IN_CLOUD: Restricts execution strictly to the cloud.

Once the review is generated, we copy it to the clipboard and use an intent to open Google Maps directly to the restaurant's review page, providing a seamless user experience:

private fun copyAndOpenMapsReview(context: Context, reviewText: String, placeId: String) {
    val clipboard = context.getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
    val clip = ClipData.newPlainText("User Review", reviewText)
    clipboard.setPrimaryClip(clip)

    val uri = Uri.parse("https://search.google.com/local/writereview/mobile?placeid=$placeId")
    val intent = Intent(Intent.ACTION_VIEW, uri).apply {
        setPackage("com.google.android.apps.maps")
    }
    context.startActivity(intent)
}

Custom hybrid routing: Hotel support chat translation with simulated personas

The hotel support chat was built to let users finalize logistics and check on hotel details. This feature uses system instructions to configure a localized receptionist assistant. By passing specific information—such as the preferred language and hotel information—in the instructions, we can set up a conversational persona representing a specific hotel.

private val generativeModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        systemInstruction = content {
            text("""
              You are a helpful hotel receptionist at $hotelName only speaking $language. 
              Answer politely in $language. The bar closes at 10pm and breakfast is from 7am to 10am.
              There's someone at the desk 24/7. You can retrieve your luggage from the storage room 
              at the back of the lobby at any time.
              """)
        },
        modelName = "gemini-3-flash-preview"
    )

Because receptionist responses are in the hotel's local language (for example, French for Hotel Le Meurice in Paris), we need to translate messages to the user’s preferred language. 

Hotel support chat messages are automatically translated to the user’s preferred language 

While hybrid models can configure simple routing preferences, complex scenarios require custom routing logic. In Jetpacker, we implement a custom routing stack that takes into account:

• Language identification: Using the on-device ML Kit Language Identification API, we can detect the incoming message language.
• On-device translation (Gemini Nano): ML Kit’s Prompt API lets us translate common language pairs directly on the device, saving bandwidth and cloud cost.
• Cloud translation (Gemini 3 Flash): For more complex languages, we use Gemini Flash 3 to get a higher quality translation.

// implementation("com.google.android.gms:play-services-mlkit-language-id:17.0.0") 

// ML Kit for Language Identification (powered by Google Play Services)
private val languageIdentifier = LanguageIdentification.getClient()

// On-device translator model (prefer Gemini Nano) for translating common language pairs
private val hybridTranslationModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash",
        onDeviceConfig = OnDeviceConfig(mode = InferenceMode.PREFER_ON_DEVICE)
    )

// Cloud translator model for more complex language pairs
private val cloudTranslationModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash"
    )

When a message needs to be translated, we identify the source language and apply our custom routing logic, executing either on-device or cloud translation:

fun translateMessage(message: SupportChatMessage) {
    viewModelScope.launch {
        // 1. Detect language using ML Kit Language Identification
        val sourceLang = try {
            Tasks.await(languageIdentifier.identifyLanguage(message.text))
        } catch (e: Exception) {
            "Undefined"
        }

        // 2. Custom routing: we've verified the translation quality for English and Korean with Gemini Nano, and will translate message on-device for those two languages
        val routeToCloud = sourceLang != "en" && sourceLang != "kr"

        val prompt = "Translate the following text to $selectedLanguage. Just return the translated sentence: ${message.text}."

        val (translatedText, routePrefix) = if (routeToCloud) {
            val result = cloudTranslationModel.generateContent(prompt)
            result.text to "[Cloud]"
        } else {
            val result = hybridTranslationModel.generateContent(prompt)
            result.text to "[On-Device]"
        }

        if (translatedText != null) {
            _translations.update { current ->
                current + (message.id to "$routePrefix: $translatedText")
            }
        }
    }
}

In this example, the custom routing logic only takes into consideration the translation’s source and target language. However, based on your app’s use case, you can expand the routing logic to include other factors such as the on-device model version, network connectivity, battery status, and more.

Securing the AI Pipelines: Firebase App Check

Lastly, using AI in the cloud opens up possibilities of API key abuse or unauthorized billing. To secure API calls, we integrated Firebase App Check using both Play Integrity (production) and the local Debug Provider (for local development or emulators).

In the JetPackerApplication.kt file, we install the debug provider at startup and trigger anonymous authentication to establish a secure user session:

//  implementation("com.google.firebase:firebase-appcheck-playintegrity") 
//  implementation("com.google.firebase:firebase-appcheck-debug")  
//  implementation("com.google.firebase:firebase-auth") 

override fun onCreate() {
    super.onCreate()
    Firebase.initialize(context = this)
    Firebase.appCheck.installAppCheckProviderFactory(
        DebugAppCheckProviderFactory.getInstance()
    )
    Firebase.auth.signInAnonymously()
}

When building locally on an emulator, App Check prints a local token secret to logcat:

Enter this debug secret into the allow list in the Firebase Console: a8c2dd4c-xxxx-xxxx-xxxx-ef6c114ba27e

Once registered in the Firebase console, local requests are fully verified and authenticated by App Check, protecting our backend while letting us test the app locally.

Conclusion

By combining cloud model capabilities (grounding, system instructions) with on-device capabilities (hybrid routing, translation, security app checks), we created a travel app that is smart, secure, and available offline.

Check out the full source code for Jetpacker on GitHub, and explore the Firebase documentation to get started:

Firebase AI Logic Documentation
Firebase Hybrid Inference API

Learn more

Check out the other parts of this blog post series:

Part 1: Introduction of the app and a high-level overview.
Part 2: On-device intelligence. Deep-dive into ML Kit’s GenAI APIs and Gemini Nano to build privacy-first features like itinerary summarization, receipt parsing, and local audio processing.
Part 3 (this post!): Hybrid and cloud reasoning. Explore how to use Firebase AI Logic to ground LLM answers in real-world data like Google Maps and web context.
Part 4: System integration. Integrating with the Android intelligence system using AppFunctions. 
Part 5 (coming soon): In-app agentic workflows. Extend the app with an end-to-end booking assistant powered by A2UI and ADK.

Interested in more on Android Development? Follow Android Developers on YouTube or LinkedIn!

All code snippets in this blog post follow the following copyright notice:

Copyright 2026 Google LLC.
SPDX-License-Identifier: Apache-2.0

Welcome to the last Community Office Hours of 2025! In this edition, Heather and Monica welcome Sr. Software Engineer Brendan Abolivier and Software Engineer Eleanor Dichary from the Desktop Team. We’re discussing the recent Exchange Web Support for email that just landed in Thunderbird Monthly Release 145. Learn how the team landed this feature and discover future plans for Calendar and Contact support, as well as Graph API

Chapters:
00:00 Intro
03:50 What is Microsoft Exchange
05:07 Why it took so long to add Exchange
14:33 Exchange in Thunderbird 145
18:20 Config options and authorization
27:10 Attachments and storage
32:30 Sync and folder operations
36:10 Filters and notification
39:10 Search
40:20 Feedback and bug reporting
43:00 Mobile and Graph API
49:09 JMAP and future protocols
55:50 Calendar and address book
59:57 Roadmap and EWS deprecation
62:23 Closing

Resources:
Exchange Mozilla Support Article: https://support.mozilla.org/en-US/kb/thunderbird-and-exchange
Exchange Mozilla Wiki Post (with call for testing): https://wiki.mozilla.org/Thunderbird%3AExchange
Reach out on Matrix: https://matrix.to/#/#thunderbird:mozilla.org
Bugzilla (use Exchange component for reporting): https://bugzilla.mozilla.org/enter_bug.cgi?product=MailNews%20Core

We've got some new faces on our growing support team! in this Community Office Hours, Heather and Monica talk to the team about the work they're doing to not only get ready for Thundermail, but improve the support experience for donors, the wider Thunderbird community, and our incredible support contributors.

Resources for Suggesting Features:
Thunderbird on Desktop and Mobile - https://connect.mozilla.org
Thundermail and Thunderbird Pro - https://ideas.tb.pro

Resources for Becoming a Community Support Contributor:
Join the Support Crew Matrix Channel - https://matrix.to/#/#tb-support-crew:mozilla.org
Learn How to Write Support Articles - https://blog.thunderbird.net/2024/07/video-learn-about-thunderbird-support-articles-and-how-to-contribute/
Learn How to Help Support Forum Users - https://blog.thunderbird.net/2024/08/video-how-to-answer-thunderbird-questions-on-mozilla-support/
Provide Feedback on Desktop Support Articles - https://github.com/thunderbird/knowledgebase-issues/issues
Provide Feedback on Android Support Articles - https://github.com/thunderbird/android-knowledgebase-issues/issues
Already a SUMO Contributor? Join the Contributor Discussion Forum - https://support.mozilla.org/forums/contributors/

Resources for Getting Help with Thunderbird:
Thunderbird for Android Support Channel (Matrix) - https://matrix.to/#/#tb-android:mozilla.org
Thunderbird Desktop Support Channel (Matrix) - https://matrix.to/#/#thunderbird:mozilla.org

Sign up to Brilliant (the first 200 sign ups get 20% off an annual premium subscription): https://brilliant.org/tldruk/

Google used to be the masters of search, but with AI tools beginning to roll out Microsoft's ChatGPT inspired "New Bing" is beginning to be real competition. So in this video we unpack how the AI race is playing out, how Google, Microsoft, Apple, Amazon and others are coping.

💬 Twitter: https://twitter.com/tldrnewsuk
📸 Instagram: http://www.instagram.com/tldrnewsuk
🎞 TikTok: https://www.tiktok.com/@tldrnews
🗣 Discord: https://tldrnews.co.uk/discord

💡 Got a Topic Suggestion? - https://forms.gle/mahEFmsW1yGTNEYXA

Support TLDR on Patreon: http://www.patreon.com/tldrnews
Donate by PayPal: https://tldrnews.co.uk/funding
TLDR Store: https://www.tldrnews.co.uk/store
TLDR TeeSpring Store: https://teespring.com/stores/tldr-spring
Learn About Our Funding: https://tldrnews.co.uk/funding

TLDR is all about getting you up to date with the news of today, without bias and without filter. We aim to give you the information you need, quickly and simply so that you can make your own decision.

TLDR is a completely independent & privately owned media company that's not afraid to tackle the issues we think are most important. The channel is run by just a small group of young people, with us hoping to pass on our enthusiasm for politics to other young people. We are primarily fan sourced with most of our funding coming from donations and ad revenue. No shady corporations, no one telling us what to say. We can't wait to grow further and help more people get informed. Help support us by subscribing, following, and backing us on Patreon. Thanks!

In which Governing Board members Amandine, Neil, Greg, Nico and Kim explain the once in a lifetime opportunity of being an elected member of The Matrix.org Foundation Governing Board!
Learn what the Board is all about, the ongoing elections, how Board members bring valuable contributions to the Foundation and their personal experience over the first two years of the Governing Board.

Links
Blog: https://matrix.org/blog/
Election Centre: https://matrix.org/foundation/governing-board-elections/2026/
About the Governing Board: https://matrix.org/foundation/governing-board/
Working Groups: https://matrix.org/foundation/working-groups/
Office of the Foundation: https://matrix.to/#/%23foundation-office:matrix.org
Office of the Governing Board: https://matrix.to/#/%23governing-board-office:matrix.org
Foundation Annual Report: https://matrix.org/blog/2026/03/annual-report/

This Week in Matrix: https://matrix.org/twim

Find Matrix.org on the internet:
🐘 https://mastodon.matrix.org/@matrix
🤝 https://www.linkedin.com/company/matrix-org
🦋 https://bsky.app/profile/matrix.org
[m] Office of the Matrix Foundation https://matrix.to/#/%23foundation-office:matrix.org

• Dao added a new Eyedropper quick action! Check it out by typing “color” or “eyedropper” in the URL bar (Bug 1803575) on Nightly.

• Henrik Skupin released geckodriver 0.37.0, which includes support for several new APIs and various bug fixes. See the release page for details.
• Starting from Firefox 153, access to local file: URLs is being restricted by default.
  • Extensions now require an explicit “Access local files on your computer” permission, separate from broad host permissions, that users must grant.
  • Extensions can call the extension.isAllowedFileSchemeAccess() API to determine whether they have been granted access to file: URLs (Bug 2034168).

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• :Vincent
• Chris Vander Linden
• DrSeed
• Khalid AlHaddad
• Sam Johnson

New contributors (🌟 = first patch)

• Francis :mckenfra: tld service for webextensions
• any1here: about:preferences#privacy is broken with MOZ_DATA_REPORTING false
• pullmana8: Fix protocol/Actor.js to throw an Error instead of an Actor
• RAN1: Firefox Crashes on Quit When Running Two Browsers With Separate Profiles

Project Updates

Accessibility

• Morgan added a new accessibility-specific, front-end review skill to mozilla central! 🎉 You can read about it, and learn how to use it in the accessibility review source docs.

Add-ons / Web Extensions

Addon Manager & about:addons

• Migrated addon-page-header and addon-card action buttons to the reusable moz-button web component as part of the ongoing Nova restyling of about:addons – Bug 2042200 / Bug 2042204
• Extended moz-page-nav-button with a forwarded title property to fix an accessibility issue where the component lacked a label in collapsed state; Landed in Firefox 153, and uplifted to Firefox 152 for about:settings which was already riding the 152 release train – Bug 2040971
• Fixed a shutdown-timing bug where a pending GMP update-check timer could fire after XPCOMShutdownThreads started, causing a pref write assertion; Fixed in Firefox 153 – Bug 2043803

WebExtensions Framework

• Fixed MV2 content scripts incorrectly injecting into guarded hosts because MozDocumentMatcher::MatchesURI was not consulting CheckGuarded when mCheckPermissions was false; Fixed in Firefox 153 – Bug 2041393
• Added support for accessing ObservableArray attributes (such as adoptedStyleSheets) from XrayWrappers and extension content scripts, unblocking extensions that rely on this Web API; Fixed in Firefox 153 – Bug 1751346
• Wired runtime_blocked_hosts and runtime_allowed_hosts enterprise policy settings through ExtensionSettings to allow administrators to restrict extension host permissions on managed devices, starting in Firefox 153 – Bug 1805205
  • Thanks to Mike Kaply for implementing this enterprise policy enhancement.

WebExtension APIs

• Fixed promiseTabWhenReady blocking indefinitely on discarded tabs, preventing cleanup of associated resources and potentially causing memory leaks; Fixed in Firefox 153 – Bug 1653876
• Fixed webNavigation.onCommitted being dispatched twice for cross-origin iframes loaded under Fission, caused by a redundant OnStateChange trigger firing in addition to OnLocationChange; Fixed in Firefox 153 – Bug 1750196

DevTools

• Chris Vander Linden made the Search input component shared as we plan to use it in the Netmonitor as well (#2019260, #2027580, #2027582)
• pullmana8 improved error management in the DevTools protocol (#2031735)
• Chris H-C :chutten removed Legacy Telemetry devtools instrumentation (#2039650)
• :glob ✱ fixed an issue in the Inspector where the swatch color for variable in @starting-style rule could have the wrong color (#2016778)
• Nicolas Chevobbe [:nchevobbe] exposed heading level more clearly in the accessibility tree (#1588784) and in the accessibility highlighter (#2044904)

• Julian Descottes [:jdescottes] migrated the markup view to HTML (from XHTML) to fix an issue when editing the markup (CodeMirror 6 does not support XHTML) (#2028058)
• Nicolas Chevobbe [:nchevobbe] fixed an issue in Netmonitor search where it could appear the the search stalled (#2042405)
• Hubert Boma Manilla (:bomsy) added more connection information (ECH, Delegated Credentials, OCSP, Private DNS, …) in Netmonitor Security tab (#2036404)

WebDriver

• Khalid AlHaddad improved the window manipulation commands in Marionette and WebDriver BiDi to allow individual window geometry properties, such as x, y, width, and height, to be adjusted independently.
• Khalid AlHaddad updated our codebase to use constants instead of hardcoded strings for all our session data types.
• Alexandra Borovova updated the “emulation.setLocaleOverride” command to also apply a locale emulation in dedicated and shared workers.
• Alexandra Borovova fixed a regression when there would be no “script.realmCreated” events after the cross-origin navigation.

Search and Urlbar

• Dharma updated context search actions to trigger search instead of entering search mode @ 1945080
• Daisuke and Drew worked on a lot of Nova updates, including ensuring Nova is tested @ 2041255, 2030183, 2019168, 2044849, 2033583
• Moritz has worked on several refactorings to allow the urlbar to be used in content @ 2039828, 2039298, 2041280
• Middle click paste replaces content was fixed by Moritz @ 2042893
• Michel added feature to show registrable domain on desktop after its implementation on mobile @ 1986161

Bots (and privacy-preserving browsers) not welcome

Browse a news site in a private window. Shop at a major retailer with a VPN. Visit a video streaming platform with anti-fingerprinting defenses tuned up. You’ll see the same responses: registration walls, block pages, and endless CAPTCHAs. The message is clear: if we think you might be a bot, you’re not welcome.

Websites have valid reasons for wanting to block bots. Bots enable volumetric abuse, abuse that wouldn’t otherwise be feasible if they had to be carried out by humans.  For example: SEO comment spam, credential stuffing and DDoSing. Consequently many sites employ dedicated anti-abuse tooling which aims to keep the bots out whilst minimizing friction for human visitors.

Unfortunately, that tooling is increasingly failing at both tasks. Browser privacy protections are dismantling the passive signals that anti-abuse systems depended on to identify and distinguish visitors. Meanwhile advances in generative AI have rendered CAPTCHAs ineffective: bots now solve them faster and more reliably than humans.

Many sites are switching to more invasive mechanisms and now ask visitors to disclose identifying information, e.g. an email address, a federated login or disabling their VPN. This means greater friction for users, since providing these details on a first visit takes time. It also compromises their privacy, since these details enable the same kinds of cross-site tracking that browser privacy protections were intended to mitigate.

This leaves users with a dilemma. The more effectively they protect their privacy, the harder it is for websites to distinguish them from bots and the worse the treatment they receive. Website operators are also suffering. The additional friction they inflict upon well-behaved visitors harms their site, but many are willing to pay the costs if it mitigates volumetric abuse.

Browser-based AI agents make this tension more acute. Sites may want to allow agents which are acting on behalf of individual users while blocking agents engaged in volumetric abuse. However, with no effective mechanisms to distinguish the two, websites are opting to block both. That hurts users, who should be free to choose the user agent they use to access the web; it hurts new browsers and agents, which struggle to interoperate; and it hurts sites, which lose legitimate visitors.

The consequence is that the web gets worse for everyone. Users get more friction or less privacy or both. Website operators see more volumetric abuse and the friction they add drives away users who would otherwise want to consume their content or services. New user agents struggle to access the same content as conventional browsers.

The Costs of Convenient Solutions

Some large ecosystem players have put forward solutions that leverage their control of the dominant operating systems and their deep integration with consumer hardware. These rely on device attestation: identifiers and privileged code baked into devices at the hardware level, which let manufacturers prove what software is running on a user’s device. Exposing this functionality to the web means attesting to sites that the user is running approved software with trusted hardware and therefore isn’t a bot. There have been two substantive proposals.

Google’s Web Environment Integrity, abandoned in 2023, was the blunt version. It attested to the user agent itself, as well as the operating system and device in use. Users would have lost control in two ways: once to the attester, which would decide which operating systems and devices could be blessed, and again to the website, which would decide which software to accept. If sites had adopted allow-lists of approved user agents, building a new browser would have become virtually impossible, and sites could have withdrawn access from any user agent they chose.

Apple’s Private Access Tokens, deployed across their ecosystem in 2022, have more subtle issues. Built on the Privacy Pass protocol standardized at the IETF, they get a lot right: a user receives a renewed, limited batch of one-time tokens that can be presented to websites without linking their visits together. This provides privacy for users and has shown rate limits to be an effective tool for sites – both points we’ll return to later in this post.

However, Private Access Tokens rely on device attestation, requiring that the hardware manufacturer be in overall control of the user’s device. Presenting a PAT tells a website you are locked into Apple’s rules for what counts as acceptable software. Due to PAT’s technical design^[1], there’s no way to open the system to other sources of scarcity without compromising the system’s privacy properties, meaning that if more widely deployed, access to the web would become tied to having bought expensive hardware from a small, hard to change set of vendors.

Both approaches are ultimately hostile to users and to the openness of the web. Both are premised on parts of a user’s device that sit within the manufacturer’s control and beyond the user’s own. Were they widely deployed, the web would become just another walled garden with centralized gatekeepers controlling acceptable hardware, operating systems and software. As convenient as these solutions are for the players who already dominate the ecosystem, we think there’s a better path.

A Better Path Forward

Bots’ harms arise from their ability to operate beyond human scale. For sites to prevent volumetric abuse they don’t actually need to know the user’s identity or receive cryptographic proof that they’re running approved software. If sites knew their visitors were restricted to a rate limit set by a site, that would be enough.  

Rate limits only make sense if they’re tied to something scarce; something an attacker can’t cheaply replicate to evade the limit. Without anchoring to a scarce resource, like the trusted hardware used in Private Access Tokens, attackers can generate as many fresh identities as they need to bypass the rate limit.

However, hardware is just one option for scarcity. Anything a user already has that an attacker can’t trivially spin up at scale will work: email addresses and phone numbers are naturally scarce. A paid subscription costs an attacker the same as a real user.  Even maintaining an account on a free service requires some non-trivial work.

What if we could use these scarce signals across the web? We could build an open ecosystem with many parties offering scarcity signals, each site choosing which to accept. By opening up who can provide a signal, and letting sites choose which to accept, we can avoid transferring control to device manufacturers and the resulting harms.

As a concrete example of who might be well positioned to provide such a signal, we can consider VPN providers acting as a subscription service. Sites routinely block VPN users indiscriminately, whether through a deliberate policy choice or through an indirect consequence of rate limiting visitors per IP address. But a VPN subscription is a perfect source of scarcity. If the VPN provider could vouch for its users so that sites could rate limit each user individually – then users would be able to browse the web with less friction and without giving up their VPN usage.

The catch is that building a system that can enable this on the open web whilst maintaining user’s privacy is genuinely difficult. It requires that we take information from one site — that this user holds some scarce thing — and expose it to other sites so that they can use that as the basis for their rate limiting. Letting one site verify a signal from another is the sort of information flow that privacy-preserving browsers have spent the last decade locking down to prevent cross-site tracking.

Our goal would be that no more than the minimum information gets through: a single bit communicating whether the user is below the rate limit set by the site. Leaking anything more – like the source of the scarcity that the rate limit is anchored to – would be unacceptable. Enabling a new cross-site information flow might feel like compromising privacy to gain better access, but reality is more nuanced. If a new system moves sites away from demanding that visitors be identifiable (whether through fingerprinting or login forms), it can be a win for both privacy and access.

The Foundations

The good news is that the cryptographic foundations for a privacy preserving approach already exist. The Privacy Pass protocol, originally developed in 2018 to reduce the friction of Cloudflare CAPTCHAs for Tor users, introduced the core primitive: a token that is unlinkable between issuance and redemption. You prove something to an issuer (e.g. by solving a CAPTCHA), receive some tokens, and later present a token to a website. The website can verify the token is legitimate, but can’t link it to the user it was issued to.

Figure 1: In Privacy Pass, a CAPTCHA provider can issue tokens to a client which can then be used to bypass challenges for future site visits. Even if the CAPTCHA provider and sites collude, they can’t use the tokens to identify the user or their browsing history.

Privacy Pass has gone on to be successfully deployed in systems where the issuer and verifier have a prior trust relationship: Apple uses it to authenticate users of Private Cloud Compute and Private Relay without linking their activity to their identity, Chrome uses it for two-hop IP protection, and Kagi uses it to provide private search. These deployments work in part because a small number of parties have agreed in advance on who issues tokens and who accepts them.

Applying this approach to an open system where any site can act as an issuer brings real challenges. Firstly, even though tokens are unlinkable, knowing a user has access to a specific issuer is a privacy leak on its own, because you can infer that the user meets the relevant issuance criteria. If one site can learn that you have a token from another site, that reveals that you have been to that site, which can be a major privacy problem. This compounds if sites can learn the set of issuers you have visited, since it becomes a fingerprint which can be used to identify you.

Generic techniques exist for proving a statement in zero knowledge: we can prove that a client has a token from a set of acceptable issuers without revealing which specific issuer it is. We’ll call this issuer blinding. The generic approach is often slow, but bespoke approaches tailored to the underlying cryptography can improve this considerably.

Another challenge is how sites using rate limits decide who to trust to issue tokens. If an issuer misbehaves then the site’s rate limits become ineffective, enabling volumetric abuse. However, if we need to prevent the site from learning which issuers a user has access to, the site is only going to know that one of its trusted issuers was used, not which one. This makes mistakes or misbehaviour by an issuer difficult to detect, and makes it hard for sites to evaluate new issuers. Solving this challenge is essential for openness. Without adequate information, sites are likely to lean towards conservative issuer selection. That could lead to less choice between Anchors, which in turn could lead to a new form of gatekeeper being created. 

To solve this, sites at least need a way to calculate an aggregate score for each issuer they use. This should roughly correspond to how much of the traffic it considers abusive to have come from users using that particular issuer. Mozilla has long invested in systems like Prio which use multiparty computation (MPC) to protect user privacy whilst enabling aggregate measurements of system behaviour.

Privacy Pass also struggles to handle dynamic adjustments to rate limits. Once tokens have been issued, they’re difficult to invalidate without either revoking all active tokens or risking attacks which can compromise the privacy of users. It’s also beneficial if sites can adjust rate limits on a per client basis, for example by increasing rate limits where they become more confident the client is benign and withdrawing access when abuse is detected.

Anonymous Credit Tokens offer a useful building block to solve this problem. Conventional Privacy Pass schemes rely on issuing a bucket of tokens but ACT works differently by enabling the use of a credential with state. For example, an ACT credential can hold an internal counter. When the credential is presented, the site can check the counter is over some threshold and mutate it, increasing or decreasing the counter whenever the site’s perception of the holder has improved or worsened. Critically, the exact value is never leaked to the site, preventing the site from tracking the holder and ensuring successive presentations of the same credential can’t be linked.

Putting it together

So how can we combine these techniques to build a system which can enable privacy-preserving rate limiting on the open web? In May 2026, we participated in a W3C CG Meeting in collaboration with Cloudflare, Chrome and other web stakeholders in which we started sketching out a design we’re calling PACT – Private Access Control Tokens.

Rate limits need a starting point, a source of scarcity to anchor on. We’ll call an entity that provides such a source an Anchor. To a user who meets the Anchor’s criteria, like having a subscription, an account in good standing, or a verified phone number, an Anchor issues a batch of Endorsement tokens, following the Privacy Pass model. In practice, Anchors could be any website which has access to this kind of signal. An Endorsement conveys scarcity to other sites.

That’s enough for a simple system where access is either granted or denied. But as we discussed earlier, we also want the ability to increase access where a visitor behaves benignly and decrease it where they don’t. The state needed to enforce a rate limit can’t live in the Endorsement, because Endorsements cross trust boundaries between unrelated sites. We need a second object that can hold that state, scoped to the party that maintains it.

We’ll call that the party that handles rate limiting for a site a Moderator and the stateful object a Credential. A Credential is specific to a Moderator and, unlike endorsements, we limit each site to nominating a single Moderator. In the common case the site itself plays the Moderator role, so there’s no new entity or trust boundary. A Moderator can also be a third-party service shared across many sites, allowing those sites to cooperatively share a rate limit. 

In the terminology of the previous section, the Anchor is the issuer of Endorsements, and the Moderator both verifies Endorsements and issues Credentials. A Moderator manages rate-limit policy: it decides which Anchors it trusts, accepts their Endorsements, and issues a Credential in return.

Figure 2: (1) Clients acquire Endorsements from Anchors in the course of normal browsing to sites they have relationships with. (2) Clients can exchange Endorsements for a stateful Credential from a Moderator. (3) Credentials can be used to access sites which use that Moderator. Credentials can be updated over time.

Directly revealing which Anchor backed an Endorsement would leak a lot of information about the user. The issuer blinding techniques from the previous section solve this: when an Endorsement is redeemed, the Moderator only learns that it came from one of the Anchors it trusts, but not which one.

When a Moderator covers more than one site, we let Credentials be presented across all of them but partition cookies and storage as we would for any other third party site. The unlinkability of Credential presentations keeps this from creating a new cross-site identifier. The benefit is that good behaviour on one site improves access on every site the Moderator covers, and bad behaviour cuts it everywhere. Websites can already build the same capability with a shared account system, so this doesn’t create a new way to lock users out, but it does provide a new way to grant access without requiring users to give up their privacy.

Enabling Moderators that cover many sites carries a centralisation risk, similar to the concentration we see today in anti-abuse providers. The mitigation is that the choice of Moderator stays with each site, and the choice of trusted Anchors stays with each Moderator. This can’t reverse the centralisation pressure the web already faces, but it ensures this system won’t lead to additional lock-in: a new Anchor or a new Moderator can be adopted without coordinating with a dominant vendor.

The system then has three flows. First, the user receives Endorsements from an Anchor in the course of normal interaction, based on the Anchor’s positive view of the user. This is a relatively rare operation for any given user and Anchor. After all, as our source of scarcity, Endorsements should not be too easy to accumulate.

Figure 3: In the course of normal browsing, clients browse to websites they have a relationship with. These sites can act as Anchors by issuing Endorsements to clients.

Second, when the user arrives at a site that works with a Moderator, the browser spends an Endorsement from an Anchor the Moderator trusts and receives a Credential in return. The presentation hides which Anchor was used, and neither the Anchor nor the Moderator can trace the Endorsement back to where it was issued. The Moderator decides what initial balance the Credential starts with. If the user has no Endorsements from suitable Anchors at all, existing mechanisms (CAPTCHAs, account creation, federated login) could be used to bootstrap a Credential the same way, so the system degrades to today’s experience rather than locking the user out.

Figure 4: When the client browses to a site, it can prompt the client for a Credential from the Moderator it uses. If the Client doesn’t have a suitable Credential, but does have a suitable Endorsement, it can exchange it for a Credential with the Moderator. In practice, the Moderator and the Site might be the same server.  

Third, as the user browses, the browser presents the Credential and the Moderator updates the internal state of the Credential. The Moderator can reward behaviour that looks benign and penalize suspicious activity, but can’t track the use of the Credential or identify it if it’s used on other sites the Moderator covers. Revocation falls out of the same mechanism: a Moderator can refuse to return an updated Credential. 

Figure 5: The Client can present the Credential on sites which use the matching Moderator. Sites can check if the Credential is in good standing. The sites can then adjust the access the Credential has in response to behaviour. E.g. increasing it when they gain confidence in the client or reducing it in response to malicious behaviour.

In practice, all of this would happen transparently to the user through a WebAPI that sites acting as Anchors or Moderators would call from JavaScript. In an ideal ecosystem, users would accumulate Endorsements through normal browsing, just by virtue of the sites they already visit, and the rest of the flow would happen in the background as they move around the web, leaving users with meaningfully less friction.

AI agents acting on behalf of a user slot into the same flow. An agent can carry its user’s Credentials, in which case the user remains accountable for how the agent behaves. Sites would not need to grant any more access than they would to the user themselves. Alternatively, the operator of an agent can run its own Anchor and vouch for its agents the way other Anchors vouch for human users. Sites retain control over which Anchors they accept, so they can choose how to treat agent traffic without needing a separate detection mechanism.

Several mechanisms combine to keep the information about a user that flows out close to a single bit. Cryptographic unlinkability ensures successive Credential presentations cannot be tied to each other or to the original issuance, so a user’s visits cannot be joined into a history. Each site is bound to a single Moderator, so the set of Moderators a user has Credentials with never becomes a cross-site fingerprint. The Anchor-to-Credential exchange happens in an isolated browsing context, so during ordinary browsing the only thing the site or its Moderator ever observes is a Credential presentation: the site only learns if the user has a valid Credential below the rate limit, or nothing. When the Moderator updates a Credential, it adjusts the credentials state without learning what it is.

The additional privacy given to users from Issuer blinding makes participating in the system more challenging for Moderators. Because the Moderator can’t see which Anchor backed a Credential at issuance, it can’t give a Credential from a strong Anchor more access than one from a weak Anchor: doing so would itself leak which Anchor was used. The initial access has to be uniform across the Moderator’s whole pool of Anchors, which in practice means setting it at the strength of the weakest. However, this is only relevant for that initial access, the Moderator can update credentials according to the holder’s behavior, enabling Credential’s to accrue access over time.

Building an open ecosystem also requires that sites can make effective decisions about the Anchors they choose to trust. Multiparty computation systems like Prio enable aggregate scoring without compromising privacy. When users present Credentials, they can provide an encrypted share which identifies the anchor they used and can be privately aggregated to compute the quality of an issuer.

Next Steps

We think the architecture we’ve sketched for PACT has the right shape, but many of the details still need to be worked out and the entire system needs rigorous privacy and security analysis.

We want to do that work in the open. The IETF is the natural venue for the cryptographic protocols underneath, and the W3C for the WebAPI surface that sits on top. We’ll be bringing draft specifications to these bodies as soon as they’re ready, and we welcome collaborators from across the ecosystem: browser vendors, site operators, anti-abuse providers, and the cryptography community.

If successful, we think we can provide a system which will keep the web open and private, while still giving sites the rate-limiting signal they need.

Acknowledgements

The ideas described here are the result of collaboration and conversations with many people, including: Watson Ladd, Thibault Meunier, Michele Orrù, Trevor Perrin, Eric Rescorla, Samuel Schlesinger, Martin Thomson, Eric Trouton, Benjamin Vandersloot & Cathie Yun. 

The post PACT: Anonymous Credentials for the Web appeared first on Mozilla Hacks - the Web developer blog.

In this post we walk through what folks have found on their journey to learn the Rust programming language with ups and downs covered.

As a disclaimer, LLMs (Large Language Models) come up in this post because our interviewees brought them up. We're scoping discussion to their use as a learning tool, covering research and example generation, not broader questions about AI (Artificial Intelligence) in software development.

Many paths to needing Rust

The interviews surfaced several different paths into Rust: curiosity, embedded work, job-market pressure, organizational adoption, and reassignment after a team or company chose Rust. That last path matters because many learners are not evaluating Rust from a blank slate; they are trying to become productive after Rust has already arrived in their work.

"Funny enough, I've advocated for more niche languages than Rust in the past. Rust has pretty much stopped being as much of a niche language as it was, but it's not Java." -- Fractional CTO

Rust learning resources

Likely as expected, the folks that we talked to reach for a range of resources to learn Rust. Some reach for official documentation, such as The Rust Programming Language Book and find that sufficient to build on what the compiler was already showing them.

"I started with the official Rust documentation because there are a lot of great examples of how features like the borrow checker work." -- Software engineer at an Automotive supplier

Others needed more passes and more formats, sometimes reaching for resources the community maintains, such as Rustlings, The Little Book of Rust Macros, and Learn Rust With Entirely Too Many Linked Lists.

"The first time I went through the chapter in [The Rust Programming Language] on borrow checking, I was like, what is this? I read it again, then I watched a YouTube video of someone explaining the chapter." -- Rust freelance consultant

"Rust book, Rustlings, Zero to Production in Rust, Jon Gjengset tutorials. A bunch of books. It's not a one-pass reading. Can't say how many times I've gone through it." -- Software engineer working on video streaming and storage

These resources have brought up an entire generation of Rust programmers. But, to some, there is a perception that these resources have trouble keeping pace with the language.

"We'd like to use [The Rust Programming Language/'the book'], but we've found that it's out of date, unfortunately. We've looked at the GitHub repo and found it's got a lot of unresolved issues and unmerged PRs" -- Principal Software Engineering work on Rust adoption in a regulated industry

Whether or not this is factually true, Rust's growth has nonetheless put more scrutiny on these materials. Companies evaluating adoption and engineers getting reassigned to Rust teams are looking at them with fresh eyes and finding the gaps that affect their own evaluation.

Beginner stumblings and unlearning habits

It's pretty typical for Rust to be the 2nd, 3rd or Nth programming language that someone picks up. They'd end up writing their most familiar language in Rust, whether C++ patterns, Java patterns, or whatever they knew, for months or even years. Eventually they got comfortable enough to start writing idiomatic Rust.

"There's a bit of a drop in productivity compared to C if you're already familiar with it just because you're learning new rules, new syntax." -- Principal Firmware Engineer (mobile robotics)

"In the beginning it was more poking around the code and adding and removing some ampersands and asterisks to try to make sense of mut and not mut and whatever." -- Senior engineer with 20 years of Java experience in cloud and IoT

We also spoke with someone who found that not having much of a programming background seemed to benefit people picking up Rust. Not having worn-in grooves from other languages may play a role here, and it's worth investigating further.

"I had someone who had never programmed much before start working on the internals of [our Rust project]. She was just fine with getting into Rust. It's more of the senior people that struggle as they need to unlearn practices which may work in other languages, but it's not the 'Rust' way." -- Researcher, Automotive OEM R&D Lab

Learning to work with the borrow checker

We heard a lot about learning to work with the borrow checker instead of against it. People get there through different paths, but a few patterns came up repeatedly.

The compiler as teacher

Rust's diagnostics did the teaching on their own, especially around lifetimes.

"If you mess up the lifetimes in a piece of code that you've written by hand, I usually find that Rust's diagnostics are very helpful" -- Researcher working on static analysis of Rust programs

"Whatever's missing, the compiler usually fills in: it tells me 'you need to declare the lifetime of this reference', so I know and can figure it out. That all generally works pretty well." -- Senior Software Engineer

Learning by doing

Others felt like they only really internalized the borrow checker after writing a lot of Rust. It took projects, coding challenges, prototyping and so on until at some point it clicked.

"I actually did not understand the borrow checker until I spent a lot of time writing Rust" -- Founder of a startup built on Rust

"Besides the prototyping work, I also did coding-challenge-type stuff to get familiar with Rust for Advent of Code. [..] It eventually clicked to the point where I wasn't fighting with Rust, it was working for me. I had that experience other people describe: when I managed to get my program to fit with Rust, it worked. I didn't spend time debugging." -- Principal Software Engineer, large SaaS provider

Letting go of "clone guilt"

Some learners arrive with the assumption that good Rust means zero clones, zero copies, lifetimes threaded through everything. They set the bar at optimal before they've learned how to write idiomatic Rust, and it makes the borrow checker feel harder than it needs to be at the outset.

"On one of my first projects, I was like, 'I don't ever want to copy or clone anything,' so I carefully wove through all the lifetimes and got myself into a bit of a bind. Then I saw someone else just cloning the struct I was working with, and it was super cheap. Sometimes you can just clone and it's going to be okay." -- Researcher at a university

The experienced Rust developers we spoke with consistently said the same thing: clone freely while you're learning, then optimize when you understand the problem. Rust's reputation for performance and correctness feeds this. Newcomers assume anything less than optimal is wrong before they've written a first working program, and clone guilt is how that shows up.

We think it could be an interesting area of future study to check into the patterns Rust programmers employ at different levels of experience and under which circumstances. One member of the Rust Vision doc team that's very experienced with Rust noted that there's kind of an "expected shape" they understand as passing the compiler. This knowledge influences how they approach writing code which wouldn't take that shape and they naturally find themselves understanding when to use so-called workarounds, such as passing around indices into arrays or Vecs.

Multi-paradigm, but not the OOP some are used to

The Rust programming language is multi-paradigm, and how that lands depends on what you're coming from. We heard some that came from a functional background were delighted with digging into learning how much Rust inherits from that lineage. Some others noted that they and others on their teams struggled to unlearn the object-oriented style they'd come to use heavily in other languages like C++ and Java.

"Developers coming from C++ tend to think object-oriented. I think that's a difference between C++ and Rust." -- Architect at Automotive OEM

"I had exactly that thing, where I would apply all my years of Java and JS thinking, where I could just create some object, not care about it, return it, have it sloshing around between various functions. Found myself reaching for these patterns and then being told 'no, you cannot do that'." -- Principal Engineer at a SaaS company

Developers coming from functional programming had less to unlearn: strong typing, pattern matching, and an expression-oriented style were already familiar.

"My background has been more functional programming, strong typing. That originated for me as a Lisper: once a Lisper, always a Lisper." -- Principal Software Engineer working on Rust tooling for safety-regulated industries

"The languages I primarily used before Rust were things like OCaml. Way back, I came from C and C++, the classic languages, and then I spent quite a long time doing primarily pure functional stuff. These days I've ended up back in what I like to think of as a pragmatic center ground [with Rust]." -- Fractional CTO

Teaching Rust in academia

We spoke with a university professor that's been teaching Rust generally. In the academic environment, they were able to use proxies for some things such as "traits are like interfaces in Java" because the students had already gone through a set of courses in their first and second years that taught them Java. They introduced concepts slowly throughout the course, choosing to deal with some more complex topics like generics later. The outcome generally was that students had no problem picking up Rust in this setting.

"I couldn't see any big difference on the embedded side. We also teach an embedded class, and we did an experiment. Half of the students' feedback was worse on the Rust class, mostly because they needed to build the project themselves. The C students just got one from [an LLM], absolutely no problem." -- University Professor, on teaching Rust

The C cohort leaned on LLMs for the project in ways the Rust cohort couldn't. We don't yet have a clear answer for why.

What did come through clearly was the Rust cohort's experience with the community. Some students needed to figure out which drivers to use for the embedded project and how to use them. Their professor encouraged them to open issues and ask questions directly on GitHub, and the maintainers responded. Students who had never contributed to open source before were getting answers from the people who wrote the code.

Learning using LLMs

Some experienced folks shared that they saw LLMs as a tool that can help someone come up to speed quickly, either as a research tool or for generating example Rust code to understand concepts.

"I'm optimistic that there's a way to work [LLMs] in that will cut down that learning curve. One of the big things these tools bring is reducing the learning curve in general; these are very good tools to help you navigate a space that you don't know yet." -- Maintainer of large open source Rust crate

"I try [LLMs] out once a month, usually for generating an example or something like this. Just like with Stack Overflow: when you read an example, you should read it carefully and try to understand it. Not copy and paste it, but type it in your own words in code and then check it, because that's where the teeny tiny little mistakes are." -- Founder of startup built on Rust

For some learners, an LLM is just another way to find answers, no different than a search engine.

"So for the most part, picking up Rust - how do I learn? I'll [use web search for] things, I'll ask [an LLM], I'll just poke around and read the code." -- Senior Software Engineer working in a regulated space

One founder went further and claimed that LLMs change who can become a Rust developer. One consulting company founder described hiring high school graduates with no systems programming background and training them as Rust developers, with LLMs filling in the learning gaps that would previously have required years of experience.

"At the beginning, I was worried, but now that we have [LLMs] supporting development, the difficulty of the language doesn't matter. I'm seeing a huge opportunity behind strong runtime languages like Rust. [..] In [Developing Country] we hire 20-25 high school graduates, train them to be Rust programmers, then they enhance our workforce worldwide." -- Founder of a consulting company

We heard this from one organization. This is a claim that the combination of Rust's compiler and LLM tooling can dramatically shorten the path from beginner to working developer. Whether it generalizes depends on questions we can't answer from a single interview: how long these developers stay, what kind of code they can maintain independently, and whether this training/learning model works outside this company's particular structure. If it holds up, the pool of people who can become Rust developers is much larger than the usual hiring profile suggests.

Organizational considerations for Rust learners

We spoke with a number of folks on teams that are using Rust in larger organizations. Teams wanted to know that everyone would end up at roughly the same level of competence, which led a good number to invest in training courses to get there. Some leaders found that staff was able to ramp well enough by reading The Rust Programming Language, going through Rustlings, and then picking up lower risk and priority tickets to work on. Having a sense of community was also important within companies; it helps people know they are not alone when they are asked to work on Rust after, say, a reorganization happens.

"[..] the idea with the class as opposed to 'just read the Rust book on your own' was that this gives everyone kind of the same baseline going in." -- Principal Firmware Engineer (mobile robotics)

"So typically we're going to have people work through Rustlings, work through The Rust Programming Language. We have them then start to pick up lower risk tickets to work on." -- Principal Engineer at a large SaaS provider

"We've got an internal Slack channel for Rust learning where people can drop questions and others will come in and answer them. That helps build up understanding and community." -- Software Engineer at a large corporation

Some organizations found that while the person they'd hire would need to learn Rust, it was still preferable to the alternative of hiring someone for a critical piece of software written in another language.

"They needed to grow and maintain this C++ codebase. They had a C++ wizard, and they tried for about two years to find someone with the same level of expertise. They ended up hiring people that didn't know Rust and ramping them up, creating FFI bindings from the C++ side so they could work in Rust. And you can feel it: the borrow checker is teaching these people the right way to handle their systems." -- Principal Engineer at an Automotive OEM

The community and helping each other aspect seems to grow bonds as organizations mature.

"Our team is [all about] mentorship. I've mentored people coming up to speed on Rust, and people help each other hugely." -- Principal Software Engineer at a large SaaS company

Silent attrition

We identified some cases where people have approached Rust and bounced off of it, for one reason or another. In the below case, someone with a background in a language with fewer guardrails found themselves frustrated enough with Rust to walk away.

"All of that means that that embedded ecosystem is very frustrating to somebody who comes from C and is like, why can't I just get a pointer to this peripheral and then write into the registers. What are you doing to me? [..] My friend never got over that. He looked at it and said, I'm not going to deal with this and walked away." -– A second University Professor

There may be language features that for a particular domain are not seen as comfortable or usable yet, such as async Rust usage in a safety domain. We'd like to map which language features feel off-limits in which domains; async in safety-critical work probably isn't the only case.

"We're not fully sure how async [Rust] will work out in the long run in our domain. [..] People don't feel comfortable yet since C++14 doesn't provide such concepts. [..] It's the chicken-and-egg problem again: we probably need to gain some experience to see whether we can actually benefit from these new concepts in the automotive and safety domains." -- Team Lead at Automotive Supplier (ASIL D target)

We heard in at least one case, that while the language was challenging and there was a near bounce, the tooling helped keep them coming back and trying.

"Well, I think my early impressions of Rust - one is I find C++ so intimidating, and I think a big part of why I was able to succeed at [..] learning Rust is the tooling. I mean, all this makes sense [..] but it's like, for me, getting started with Rust, the language was challenging, but the tooling was incredibly easy." -- Founder of another startup built on Rust

While it might be considered more of a community concern, if there are interactions online and in spaces that point to learners having so-called "skill issues" this feeds into the narrative that Rust must be hard to learn. We may be unintentionally turning away Rust Project contributors and maintainers due to the vibes being put out when new learners show up in certain spaces.

"People are very helpful, but generally the attitude is: if your program is very complicated, it's mostly a skill issue. There's not that much empathy when people get stuck learning, and a lot of people are just pushed away by it. There's probably a huge number of people who silently stop wanting to write Rust, because at some point it gets complicated and the feedback they get is 'you just need to be a better programmer, obviously'." -- Software Engineer at a SaaS Provider

Feedback on near-bounces from survey

We found a few interesting perspectives collected in the Rust Vision doc survey which we administered with examples of bouncing and coming back:

"I started before 1.0, got stuck very soon when trying to translate patterns from C++ to Rust (due to borrow checking). I tried again after 1.0 and it stuck. [..]" -- Survey Respondent A

Survey Respondent A went on to share in a more detailed response about a perceived weakness in Rust learning materials related to lifetimes and the borrow checker are explained. There was an observation that it's fairly easy to run into more complex situations with lifetimes and the borrow checker. They felt that the current state of this sort of material and tutorials is fairly superficial and can leave learners stuck when they run into those more complex situations.

One respondent that bounced once and came back shared challenges around usage of async. In concert with Rust's memory-safety and the borrow checker, they found some of the nitty-gritty details of async were difficult to learn. While we're aware of the Rust Project's continuous efforts to improve Rust's async story, this is another data point of a user that faced challenges.

Another survey respondent shared how they had multiple times bounced in trying to learn Rust. They returned after a year or so and found Rustlings to be highly motivating. We note that having multiple pathways for folks to learn Rust opens up more possibilities for those that nearly bounced, just like this person.

Need more focused work on silent attritrion

The thing that stood out most to us was the lack of real, first-hand knowledge of having bounced when learning Rust. While this is an obvious effect of soliciting answers to our survey and opportunities to interview through Rust channels and our networks, this cohort is good future candidate where interviews could start.

Conclusions

Across these conversations, the experience of learning Rust depended heavily on context. Why someone was learning and what support they had mattered as much as the borrow checker. The same kinds of examples kept coming up: a training course that got a team to a shared baseline, a maintainer answering a student's first GitHub issue, and a colleague whose code showed that cloning was okay.

That context is largely something the community has a hand in. With that in mind, here is what we take away from what we heard, and what we still don't know.

What seems worth trying

Learning materials aimed at unlearning. Syntax barely came up when people described their struggles. People struggled with unlearning habits from previous languages, whether OOP structuring from C++ and Java or the instinct to grab a raw pointer to a peripheral. Most of our learning materials teach Rust from first principles, and that works. What we didn't come across is much written for, say, the engineer with ten years of Java who lands on a Rust team after a reorg: material that names the patterns they'll reach for that won't transfer, and shows what to do instead. The professor we spoke with did a version of this in the classroom, leaning on "traits are like interfaces in Java" and saving generics for later in the course, and the students did fine. Something similar could work outside the classroom too.

Put the "clone freely while you're learning" advice somewhere official. Every experienced developer we spoke with gave the same advice, but learners seem to mostly pick it up by accident, like the researcher who happened to see someone else cloning the struct they had been carefully threading lifetimes through. Saying it early in official materials would take some of the steepness out of the curve. The broader version belongs there too: idiomatic Rust doesn't have to mean optimal Rust, especially on a first project.

Diagnostics are already a primary learning resource: several people told us the compiler taught them lifetimes before any documentation did. Diagnostics reach learners right at the moment they're stuck. When writing new ones, it seems worth keeping the confused newcomer in mind alongside the expert, because for a lot of people this is where the learning happens.

Is "the book" actually out of date? Whether or not The Rust Programming Language or other materials are actually behind, a team evaluating Rust looked at its repository, saw unresolved issues and unmerged PRs, and moved on. As more companies evaluate adoption, more people will look at these materials with the same fresh eyes. Visible issue triage and some communication about what's current and what's planned would address the perception, separately from whatever content work may or may not be needed.

How stuck learners get treated is shaping who stays. We heard about students getting answers on GitHub from the maintainers who wrote the code, and we heard about learners being told their struggles were a skill issue. The first group came away with a lasting good impression of Rust. Some of the second group walked away entirely, and because they leave quietly, it's easy to underestimate how many of them there are. The welcoming side of the community came up unprompted as a reason people stayed, so we know it makes a difference when we get this right.

Every organization we spoke with described essentially the same ramp-up for bringing a team to Rust. Teams that brought groups of developers to Rust described roughly the same approach: get everyone to a shared baseline with a training course or with The Rust Programming Language and Rustlings, start people on lower-risk tickets, and give them somewhere internal to ask questions. Several organizations also found that hiring developers without Rust experience and ramping them up worked out better than continuing to search for rare expertise in another language. None of this is complicated, and teams weighing adoption don't need to invent a training program from scratch.

What we still don't know

The biggest gap is the people we didn't reach. Nearly everyone we spoke with stuck with Rust long enough to be reachable through Rust channels, so the stories of bouncing off came to us second-hand: a friend who walked away from embedded Rust, colleagues who quietly stopped after the responses they got. As we wrote in our first post, finding people who decided against Rust takes targeted outreach. If the proposed User Research team comes together, talking with learners who bounced would make a good early project, and learning is probably the area where that research would teach us the most.

We also don't know what to make of LLMs as a learning tool yet. They came up as a search engine, as an example generator, and in one organization's case as something that makes training high school graduates into working Rust developers possible. We saw a classroom where the C cohort leaned on LLMs in ways the Rust cohort couldn't, and we don't have an explanation for it. All of this comes from a handful of conversations, so we treat it as a set of leads to follow up on. Given how quickly the tools are changing, it seems better to study this deliberately than to wait and see what folklore develops.

The folks we spoke with showed that people do get there: with enough passes through the materials and enough code written, it eventually clicks. The opportunities above are mostly about making it work for the people who didn't pick Rust on purpose, and for the ones who would have stuck around if their early experience had gone a little differently.

Keep your computer safe with BitDefender: https://bit.ly/BitdefenderNC (59% discount on a 1 year subscription)


Here are the top 40 Windows Command Prompt commands you need to know!! From using ipconfig to check your IP Address to using the shutdown command to automatically boot to bios, these commands are essential for any Windows user. Also, is your computer running slow? We show a series of commands that will speed up your computer without having to reinstall Windows. All of these commands should work on Windows 10 and Windows 11 and all you need to do is launch your windows command prompt (cmd).




🔥🔥Join NetworkChuck Academy: https://ntck.co/NCAcademy



**Sponsored by Bitdefender







SUPPORT NETWORKCHUCK
---------------------------------------------------
➡️NetworkChuck membership: https://ntck.co/Premium
☕☕ COFFEE and MERCH: https://ntck.co/coffee

Check out my new channel: https://ntck.co/ncclips

🆘🆘NEED HELP?? Join the Discord Server: https://discord.gg/networkchuck

STUDY WITH ME on Twitch: https://bit.ly/nc_twitch

READY TO LEARN??
---------------------------------------------------
-Learn Python: https://bit.ly/3rzZjzz
-Get your CCNA: https://bit.ly/nc-ccna

0:00 ⏩ Intro
0:15 ⏩ Launch Windows Command Prompt
0:18 ⏩ ipconfig
0:25 ⏩ ipconfig /all
0:33 ⏩ findstr
0:49 ⏩ ipconfig /release
0:56 ⏩ ipconfig /renew
1:15 ⏩ ipconfig /displaydns
0:56 ⏩ ipconfig /renew
1:29 ⏩ clip
1:47 ⏩ ipconfig /flushdns
2:09 ⏩ nslookup
2:41 ⏩ cls
2:51 ⏩ getmac /v
3:01 ⏩ powercfg /energy
3:10 ⏩ powercfg /batteryreport
3:28 ⏩ assoc
3:51 ⏩ Is your computer slow???
3:56 ⏩ chkdsk /f
4:07 ⏩ chkdsk /r
4:17 ⏩ sfc /scannnow
4:36 ⏩ DISM /Online /Cleanup /CheckHealth
4:45 ⏩ DISM /Online /Cleanup /ScanHealth
4:51 ⏩ DISM /Online /Cleanup /RestoreHealth
5:24 ⏩ tasklist
5:38 ⏩ taskkill
5:59 ⏩ netsh wlan show wlanreport
6:18 ⏩ netsh interface show interface
6:27 ⏩ netsh interface ip show address | findstr “IP Address”
6:30 ⏩ netsh interface ip show dnsservers
6:36 ⏩ netsh advfirewall set allprofiles state off
6:43 ⏩ netsh advfirewall set allprofiles state on
6:49 ⏩ SPONSOR - BitDefender
8:19 ⏩ ping
8:30 ⏩ ping -t
8:41 ⏩ tracert
8:59 ⏩ tracert -d
9:06 ⏩ netstat
9:12 ⏩ netstat -af
9:28 ⏩ netstat -o
9:38 ⏩ netstat -e -t 5
9:47 ⏩ route print
9:58 ⏩ route add
10:13 ⏩ route delete
10:21 ⏩ shutdown /r /fw /f /t 0


FOLLOW ME EVERYWHERE
---------------------------------------------------
Instagram: https://www.instagram.com/networkchuck/
Twitter: https://twitter.com/networkchuck
Facebook: https://www.facebook.com/NetworkChuck/
Join the Discord server: http://bit.ly/nc-discord




AFFILIATES & REFERRALS
---------------------------------------------------
(GEAR I USE...STUFF I RECOMMEND)
My network gear: https://geni.us/L6wyIUj
Amazon Affiliate Store: https://www.amazon.com/shop/networkchuck
Buy a Raspberry Pi: https://geni.us/aBeqAL
Do you want to know how I draw on the screen?? Go to https://ntck.co/EpicPen and use code NetworkChuck to get 20% off!!



#windows11 #commandprompt #cmd

I know your password. Change it with Dashlane: https://www.dashlane.com/networkchuck50 (Use code networkchuck50 to get 50% off)

In this video, NetworkChuck shows you the top 50 MacOS terminal commands you NEED to know. Now, while Mac OS is unix-based and very similar to Linux, it has its nuances and things worth paying attention to. Things like, making your Macbook talk, finding wifi passwords, diving into the matrix and taking a trip to the aquarium, all from your terminal.




🔥🔥Join Hackwell Academy: https://ntck.co/NCAcademy



**Sponsored by Dashlane







SUPPORT NETWORKCHUCK
---------------------------------------------------
➡️NetworkChuck membership: https://ntck.co/Premium
☕☕ COFFEE and MERCH: https://ntck.co/coffee

Check out my new channel: https://ntck.co/ncclips

🆘🆘NEED HELP?? Join the Discord Server: https://discord.gg/networkchuck

STUDY WITH ME on Twitch: https://bit.ly/nc_twitch

READY TO LEARN??
---------------------------------------------------
-Learn Python: https://bit.ly/3rzZjzz
-Get your CCNA: https://bit.ly/nc-ccna

FOLLOW ME EVERYWHERE
---------------------------------------------------
Instagram: https://www.instagram.com/networkchuck/
Twitter: https://twitter.com/networkchuck
Facebook: https://www.facebook.com/NetworkChuck/
Join the Discord server: http://bit.ly/nc-discord

0:00 ⏩ Intro
0:12 ⏩ say
0:23 ⏩ security find-generic-password -wa Wifi
0:40 ⏩ pbcopy
0:54 ⏩ command + option + shift + v
1:08 ⏩ caffeinate
1:20 ⏩ command + shift + 3
1:53 ⏩ defaults write com.apple.screencapture name
2:10 ⏩ defaults write com.apple.screencapture type
2:19 ⏩ default write com.apple.screencapture location ~/Desktop/screenshots
2:40 ⏩ passwd
4:11 ⏩ cd
4:17 ⏩ ls
4:20 ⏩ pwd
4:26 ⏩ whoami
4:32 ⏩ mv
4:36 ⏩ cp
4:41 ⏩ ditto
4:48 ⏩ df -h
4:51 ⏩ nano
5:00 ⏩ man
5:09 ⏩ open
5:18 ⏩ ping
5:25 ⏩ ifconfig
5:36 ⏩ grep
5:43 ⏩ awk
5:53 ⏩ traceroute
6:04 ⏩ dig
6:12 ⏩ ps
6:21 ⏩ top
6:31 ⏩ kill
6:47 ⏩ which $SHELL
6:56 ⏩ bash
7:00 ⏩ zsh
7:05 ⏩ uptime
7:10 ⏩ killall mDNSResponder….and more
7:15 ⏩ qlmanage
7:22 ⏩ diff
7:27 ⏩ curl
7:42 ⏩ leave
7:54 ⏩ history
7:59 ⏩ disable gatekeeper
8:20 ⏩ brew
8:46 ⏩ cmatrix
9:02 ⏩ asciiquarium
9:13 ⏩ toilet
9:31 ⏩ tetris
9:48 ⏩ python3
10:18 ⏩ shutdown
10:33 ⏩ sudo touch id


AFFILIATES & REFERRALS
---------------------------------------------------
(GEAR I USE...STUFF I RECOMMEND)
My network gear: https://geni.us/L6wyIUj
Amazon Affiliate Store: https://www.amazon.com/shop/networkchuck
Buy a Raspberry Pi: https://geni.us/aBeqAL
Do you want to know how I draw on the screen?? Go to https://ntck.co/EpicPen and use code NetworkChuck to get 20% off!!



#MacOS #Terminal #brew

NVIDIA just unveiled Rubin, but this isn't just another GPU. It's a complete AI factory built to power the next generation of artificial intelligence. In this video, we break down NVIDIA's Vera Rubin platform, a fully co-designed AI system that combines the Vera CPU, Rubin GPU, NVLink 6, BlueField-4 DPU, ConnectX-9 SuperNIC, and Spectrum networking into one massive AI infrastructure platform. You'll learn why Rubin delivers up to 50 petaflops of AI inference, 288GB of HBM4 memory per GPU, 3.6 exaflops of compute per NVL72 rack, over 260TB/s of NVLink bandwidth, and why NVIDIA claims up to 10x lower AI inference costs than Blackwell. We also explore why AI companies like Microsoft, OpenAI, Anthropic, Meta, xAI, Google, AWS, Oracle, and CoreWeave are already adopting Rubin, and why NVIDIA believes the future of AI isn't a faster GPU; it's an entire factory built to manufacture intelligence. Is Rubin the biggest leap in AI hardware yet, or the beginning of a completely new era of AI infrastructure?

#NVIDIA #Rubin #AIFactory #AIChips #ArtificialIntelligence #HBM4 #DataCenter

Thanks to Micron for sponsoring this video!

To learn more about High-Bandwidth Memory (HBM), check out: https://www.micron.com/products/memory/hbm

Interested in helping to shape the future of cutting edge memory and storage: https://www.micron.com/about/careers

Modern AI chips don't run on the kind of memory in your gaming PC. They run on something that's literally stacked into a tiny skyscraper, with tens of thousands of microscopic data tunnels drilled through it and a custom silicon motherboard underneath. We sat down with the engineers at Micron to break down how High Bandwidth Memory actually works, why it's the backbone of every serious AI accelerator on the planet, and why your gaming GPU still uses a totally different kind of memory.

Leave a reply with your requests for future episodes.

► SHOP OUR PRODUCTS: https://lttstore.com
► GET A VPN: https://www.piavpn.com/TechQuickie
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners

As a small boy growing up in Amritsar, India, in the 1960s, Avtar Singh used to hear whispers. Your mum isn’t really your mum, the rumours would say. Your mum lives abroad. Avtar didn’t really pay any attention to it. “I thought, the neighbours are just making up stories.” But the stories were true: the woman raising Avtar was actually his grandmother. When he was too young to remember it, his father had emigrated to Canada to work as a teacher, leaving Avtar in the care of his paternal grandparents. His grandfather, a police officer, was a fearsome authoritarian, but his grandmother brought him up with tenderness, as if he were her own son. She called him by his nickname, Titu. He felt loved.

When Avtar was around eight years old, he was told about his family in Canada: his dad, his mum and a little brother were waiting for him there, and he would soon travel to join them. Just after his ninth birthday, Avtar found himself sitting on a plane, dressed in a three‑piece suit and tie. He was travelling alone. He had never flown before. He didn’t speak a word of English. He landed in Halifax, Nova Scotia, on Christmas Eve, 1968; his family met him at the airport and took him home. “I didn’t know what to think,” Avtar, now 66, tells me in a video call from his home in Abbotsford, British Columbia. “Before I knew it, it was the first week of January, and I was put in school.”

Every weekday, Matt, a software engineer, looks forward to his four-hour train commute to Pawling, New York. It’s time he uses to work on his own project: a browser-based video game for which he writes every line of code himself.

“I am actively trying to keep my axe sharp,” said Matt, who did not want to use his actual name, to protect his employment. In the last six months, Matt’s job has increasingly shifted away from coding, problem solving and software architecture towards reviewing code generated by artificial intelligence. Convinced that the shift will weaken his skills, he’s doing what he can to keep them intact. “I am trying not to leverage AI where I can.”

We recommend to read this FAQ before using a pre-release in a production environment.

Please use the attached archives for installing or updating Matomo.
The source code download is only meant for developers and will require extra work to install it.

• Latest stable production release can be found at https://matomo.org/download/ (learn more) (recommended)
• Beta and Release Candidate releases can be found at https://builds.matomo.org/ (learn more)

James Kettle, Director of Research at Portswicker, shares how insights from a Black Hat presentation helped inspire research that ultimately uncovered vulnerabilities affecting nearly 30 million websites. Learn why Black Hat remains a vital destination for cutting-edge security research, collaboration, and discovering the techniques that could shape the future of cybersecurity.

On this episode, Gaurav Keerthi, CEO and Founder of StrongKeep Cybersecurity, shares why Black Hat continues to be a must-attend event for the cybersecurity community.

With every Black Hat experience offering something different, Black Hat brings together passionate individuals, innovative companies, and deep technical expertise in one place. '

From thought-provoking discussions on stage to valuable conversations throughout the event, Black Hat creates unique opportunities to learn, connect, and exchange ideas with the people shaping the future of cybersecurity.

Why do cybersecurity professionals keep coming back to Black Hat? Gaurav Keerthi, CEO and founder of StrongKeep shares why learning happens everywhere, from the stage to the conversations in between.

The post A Complete Guide to Fidelis EDR Agents and Their Core Security Roles appeared first on Fidelis Security.

Google Sheets now offers enhanced support for combo charts, providing a more seamless experience when creating multi-series visualizations. | Learn more.

A centralized hub for meeting resources on the new Google Meet homepage

Finding the right notes or attachments for a meeting shouldn't feel like a scavenger hunt. We’re introducing a revamped Google Meet homepage on the web to help you stay organized and prepared throughout your entire meeting workflow. | Learn more.

Redesigned Google Classroom homepage with tailored views based on user’s role

Soon, Google Classroom will introduce a redesigned homepage globally across all editions to help teachers, students, and administrators easily find relevant content, resources, and tools tailored to their specific roles. | Learn more.

Gemini Alpha is now Gemini Beta

We’re updating the name of the Gemini Alpha program to "Gemini Beta." This new name more accurately reflects both the scale and the quality of the features that enter this launch stage. Please note that this is solely a branding change. This update does not alter any customer configurations, data privacy constraints, or pricing tiers. | Learn more.

Google Meet now organizes your meeting notes, transcripts, and recordings in your Google Drive

We’re making it easier for users to find meeting notes, transcripts and recordings in Google Drive. | Learn more.

View supporting calendar delegates in meeting guest list

When viewing a guest list in Google Calendar on the web, you will now see a new icon next to leaders who have a calendar delegate assisting them with scheduling support. Hovering over the icon will display the person’s information, allowing you to easily initiate a chat with them directly. | Learn more.

The announcements above were published on the Workspace Updates blog over the last week. Please refer to the original blog posts for complete details.

A partial list of changes is available in the Git log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Chrome Release Team
Google Chrome

You're reading Firefox’s new tab page adds AI-powered daily crossword widget, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

Read more →

The post Expert Density as Strategy: How 2F-IT Built One of Germany’s Deepest Fortinet Practices appeared first on IT Security News.

Selecting the most rigorous certification path today provides long term benefits for product manufacturers.

@Wei Yuan suggests that choosing high assurance schemes offers better flexibility as technology requirements change. Here’s why:
Strict schemes reduce the overall cost of ownership over time.
High assurance solutions live longer within evolving regulatory timelines.
Early investment prevents the need for a mass migration in just a few years.

Robust compliance paths offer more certainty for international markets.
Learn why high assurance evaluation saves costs over time. Listen to the full episode today!

#Certification #PQC #TechStrategy #AppplusLabs

• The best games of 2026 so far

Comfort is crucial to the gaming experience. It’s hard to focus on blasting aliens or taking Stoke to the Champions League final if your bum has gone to sleep because you’ve been sitting on an old chair for three hours. We’re spending more time playing games than ever before, so good posture matters. If you have set up a dedicated gaming space, then a rickety seat just won’t cut it.

From luxurious ergonomic thrones to cheap-and-cheerful bucket seats, the options available are bewildering. So I set out on an epic quest: to find the most comfortable, durable and stylish gaming chairs. Here’s what I discovered.

Best gaming chair overall:
Secretlab Titan Evo

Best budget gaming chair:
ThunderX3 Solo 360

Jedes neue Android-Smartphone durchläuft bei mir dasselbe Ritual: Noch bevor die erste App startet, klicke ich mich durch fünf Einstellungen, die – wie ich finde – jedes Handy von Werksseite aus schon (de-)aktiviert haben sollte. Welche das sind, zeige ich Schritt für Schritt.

Hinweis: Ich selbst nutze ein Samsung-Smartphone. Die genauen Menüpfade und Bezeichnungen, die Sie in diesem Artikel finden, können bei anderen Android-Herstellern leicht abweichen. Die grundlegenden Funktionen finden Sie aber bei jedem Android-Gerät, meist nur unter leicht anderem Namen oder an anderer Stelle in den Einstellungen.

1. Personalisierte Werbung deaktivieren

Google und viele App-Anbieter verknüpfen Ihr Nutzungsverhalten über eine sogenannte Werbe-ID mit Ihrem Profil, um Anzeigen zuzuschneiden. Ich schalte das ab, weil ich schlicht nicht möchte, dass mein halbes digitales Leben zu Werbezwecken ausgewertet wird:

1. Öffnen Sie Einstellungen > Sicherheit & Datenschutz > Weitere Datenschutzeinstellungen.
2. Deaktivieren Sie im Abschnitt Google die Funktion “Android-Personalisierungsdienst” und tippen Sie anschließend auf “Werbung” > “Werbe-ID löschen”.

Damit unterbinden Sie zwar nicht jede Form von Werbung, aber die Anzeigen werden deutlich weniger zielgerichtet auf Sie persönlich ausgespielt. Mehr zu versteckten Tracking-Funktionen von Google lesen Sie hier: Diese Google-Funktion überwacht Sie heimlich – so deaktivieren Sie das.

PC-Welt

Wenn Sie es mit Datentracking ganz genau nehmen, empfehle ich Ihnen, unter myaccount.google.com noch die Aktivitätseinstellungen für Ihr Google-Konto zu prüfen.

2. Sperrbildschirm-Benachrichtigungen ohne Inhalte anzeigen

Standardmäßig zeigt Android Nachrichteninhalte, Absendernamen und teils sogar Codes für die Zwei-Faktor-Authentifizierung direkt auf dem gesperrten Bildschirm an – lesbar für jeden, der Ihr Handy in die Hand nimmt! Das ändere ich als Erstes, sobald ein Gerät neu eingerichtet ist:

1. Gehen Sie zu Einstellungen > Benachrichtigungen.
2. Wählen Sie “Inhalt bei Sperrung ausblenden”.
3. Stellen Sie auf “In gesperrtem Zustand ausblenden”.

Sie können das Ganze auch einzeln pro App festlegen, statt nur systemweit: Öffnen Sie dazu Einstellungen > Apps > [gewünschte App] > Benachrichtigungen und legen Sie dort separat fest, ob Nachrichteninhalte dieser App auf dem Sperrbildschirm angezeigt oder ausgeblendet werden sollen. 

Eine ausführliche Übersicht weiterer Schutzmaßnahmen finden Sie in diesem Ratgeber: Schützen Sie Ihr Smartphone mit diesen 7 Android-Datenschutzeinstellungen.

3. Akku-Optimierung pro App statt pauschalem Sparmodus

Den generischen Energiesparmodus finde ich zu grob, zumal ich Apps habe, die im Sparmodus nicht optimal laufen können. Deshalb schränke ich gezielt die Apps ein, die im Hintergrund unnötig Strom ziehen, und passe ein paar Display-Einstellungen an:

1. Öffnen Sie zunächst Einstellungen > Akku. Unterhalb der Nutzungsanzeige sehen Sie, welche Apps am meisten Akku verbrauchen. Öffnen Sie nun diese akku-hungrigen Apps unter Einstellungen > Apps > [App] > Akku und stellen Sie die Einstellung von “Nicht eingeschränkt” auf “Optimiert” oder “Eingeschränkt”.
2. Reduzieren Sie unter Einstellungen > Anzeige die Bildwiederholrate von 90/120 Hertz auf 60 Hertz (bei Samsung “Standard“), falls Sie keine animationsreichen Spiele spielen und auch sonst nicht besonders auf butterweiches Scrollen angewiesen sind. Beim reinen Surfen, Chatten oder Videoschauen fällt Ihnen der Unterschied kaum auf, da Filme und Serien ohnehin überwiegend mit deutlich niedrigerer Bildrate laufen.
3. Deaktivieren Sie Always-on-Display (unter Einstellungen > Sperrbildschirm und AOD), wenn Sie es ohnehin selten ansehen.

Diese drei Handgriffe bringen im Alltag oft mehr als jeder Sparmodus-Knopf. Hier finden Sie eine vollständige Liste weiterer Stellschrauben: 13 Einstellungen, mit denen Ihr Smartphone-Akku länger hält.

PC-Welt

4. Berührungsempfindlichkeit für Displayschutzfolien aktivieren

Ohne Panzerglasfolie auf dem Display geht bei mir gar nichts. Allerdings kenne ich noch die Zeiten, in denen ich mich mit hakeligen Wischgesten und dem Entsperren per Fingerabdruck herumschlagen musste, weil die Touchscreen-Eingaben durch die Folien stark gedämpft waren.

Eines Tages bin ich auf die Einstellung “Berührungsempfindlichkeit“ gestoßen und – siehe da – alle Folien-Probleme haben sich in Luft aufgelöst. Diese Einstellung ändere ich deshalb bei jedem neuen Handy mit Schutzfolie sofort:

1. Öffnen Sie Einstellungen > Anzeige.
2. Suchen Sie den Punkt “Berührungsempfindlichkeit” und aktivieren Sie ihn.

Mit aktivierter Berührungsempfindlichkeit reagiert der Touchscreen wieder so präzise wie ohne Folie. Sie werden den Unterschied sofort bemerken.

5. Automatisches Backup sofort aktivieren

Zum Glück habe ich noch nie ein Backup meiner Daten benötigt, aber allein der Gedanke an ein verlorenes, gestohlenes oder kaputtes Handy ohne Sicherung reicht mir, um bei jedem neuen Gerät sofort vorzusorgen. Denn das Aktivieren geht wirklich super schnell und reibungslos:

1. Öffnen Sie Einstellungen > Konten und Sicherung.
2. Falls Sie ein Samsung-Handy haben: Tippen Sie unter Samsung Cloud auf “Daten sichern”, um Kontakte, Kalender, Notizen und App-Daten geräteseitig zu sichern.
3. Aktivieren Sie zusätzlich im selben Menü das Backup über Google Drive, damit Ihre wichtigsten Daten auch herstellerunabhängig gesichert sind.
4. Öffnen Sie außerdem Google Fotos und schalten Sie dort separat die automatische Sicherung für Fotos und Videos ein.
5. Aktivieren Sie bei Bedarf zusätzlich das Backup für Messenger wie Whatsapp (Einstellungen innerhalb der jeweiligen App).

Wie Sie beim Gerätewechsel wirklich alle Daten mitnehmen – inklusive Chatverläufe und Einstellungen –, beschreiben wir in Smartphone-Umzug: So nehmen Sie Ihre Daten mit. Eine komplette Einrichtungs-Checkliste für ein neues Gerät liefert außerdem der Leitfaden So richten Sie Ihr neues Android-Smartphone ein.

On 14 February 2019, OpenAI announced a language model called GPT-2, the precursor to the models that power modern AI chatbots and agents such as ChatGPT and Claude. But OpenAI declared GPT-2 was too risky to release, citing concerns about safety and abuse.

I recall being annoyed at the time that OpenAI would make such a useless announcement: the risks seemed overblown, and without access to the model there wasn’t much for a researcher like me to learn about GPT-2.

Throughout history, many things have been seen by terrified populaces as a harbinger of doom. A comet. A crow on the battlefield. A solar eclipse. A mutant livestock birth. Yet times move on. In the modern era, the leading harbinger of doom is literally any picture of the OpenAI CEO, Sam Altman, attached to a news story. You know it’s not going to be good, right? You know that by the time you’ve read it, you’ll be begging to go back to the time when the worst thing that could happen to us at the hands of the techlords was just some democracy-subversion, or childhood destruction, usually followed by Mark Zuckerberg putting on a suit and claiming: “We will learn from this.”

Anyway: a lot of pictures of Sam Altman in the news of late. Most recently, this week, one darkened the skies alongside the tale of how an OpenAI autonomous agent went rogue during a supposedly sandboxed/guardrailed test, and hacked a major startup that functions as a repository of coding information. (I’m slightly obsessed with the fact that the startup in question is called Hugging Face, adding weight to my suspicion that some vast, tweely benign emoji is the last face humanity will see before it dies.)

Marina Hyde is a Guardian columnist

Read more of this story at Slashdot.

The post AI for SMEs: closing the readiness-reality gap between ambition, execution and measurable value appeared first on SME Cybersecurity News.

Ein Netflix-Abo hat mittlerweile so gut wie jeder, doch der eine oder andere wartet vielleicht noch auf eine Möglichkeit, das Streaming-Angebot kostenlos zu testen. Das war seit den Anfängen von Netflix nicht mehr möglich, doch jetzt gibt es wieder einen kostenlosen Probezeitraum.

Bis zu 30 Tage können Sie den Streamingtest jetzt kostenlos nutzen. Teilweise werden auch nur 14 Tage angeboten, der Gratis-Zeitraum scheint also je nach Standort oder genutztem Browser zu variieren. Auf der Webseite von Netflix Deutschland wurden uns auch nur 14 Tage für 0 Euro angezeigt. Es kann aber helfen, wenn Sie auf ein anderes Gerät wechseln oder Cookies löschen.

Wichtig: Das Angebot gilt explizit nur für Neukunden, nicht für wiederkehrende Abonnenten. Allerdings ist es recht einfach, diesen Umstand zu umgehen, wenn Sie sich einfach mit einer anderen E-Mail-Adresse als zuvor registrieren. Dann haben Sie zwar keinen Zugriff auf Ihren alten Account inklusive persönlicher Daten, Listen und Streaming-Historie, doch das ist sicher zu verschmerzen.

Nach Ablauf des Probezeitraums müssen Sie sich für ein Abo entscheiden (oder vorher kündigen). Zur Wahl stehen Standard mit Werbung für 4,99 Euro monatlich, Standard ohne Werbung für 13,99 Euro monatlich oder Premium für 19,99 Euro monatlich.

Warum genau Netflix gerade jetzt ein Probe-Abo wieder einführt, ist nicht ganz klar. Vermutlich versucht der Anbieter aber, neue Abonnenten dazu zu gewinnen, nachdem die Zahlen zuletzt stagnierten. Zwar ist Netflix der größte Anbieter für Streaming, doch die Konkurrenz schläft nicht. Seit Januar 2026 gibt es beispielsweise auch HBO Max in Deutschland, das mit großen Namen wie Game of Thrones, House of the Dragon, Harry Potter oder Superman wirbt.

Eine Übersicht aller wichtigen Streaming-Dienste finden Sie hier, inklusive Preisen, Vorteilen und Nachteilen.

Zwei große Änderungen hat es in den vergangenen Jahren bei Phishing-Angriffen gegeben: Die Kriminellen erstellen mithilfe von generativer KI sprachlich fast perfekte Mails, die in Stil, Struktur und Tonalität kaum noch von legitimen Nachrichten zu unterscheiden sind. Wo früher holpriges Deutsch sofort Misstrauen geweckt hat, liest sich heute eine Phishing-Mail wie eine echte Mitteilung von Microsoft, einer Bank oder einem Paketdienst.

Auch das Design wirkt meist höchst professionell. Zum anderen sind auch die technischen Tricks beim Datendiebstahl heute höher entwickelt. Einige Maschen umgehen sogar eine Zwei-Faktor-Authentifizierung. Das Ziel der Angreifer bleiben vor allem Zugangsdaten, Session-Tokens und persönliche Infos.

1. Microsoft-365-Log-in-Falle trickst Zwei-Faktor-Anmeldung aus

Eine neue Angriffsmethode verwendet den originalen Microsoft-Anmeldedialog und kommt entsprechend fast ohne gefälschte Webseiten aus. Die Kriminellen nutzen dafür den Oauth-Device-Code-Flow. Das ist ein Anmeldeverfahren für Geräte oder Programme, die keinen brauchbaren Browser oder keine komfortable Texteingabe bieten, etwa Smart-TVs, IoT-Geräte, Drucker oder CLI-Tools.

Offiziell heißt er „OAuth 2.0 Device Authorization Grant“. Mit der Methode lassen sich auch Konten übernehmen, die mit einer Zwei-Faktor-Authentifizierung geschützt sind.

Die Kriminellen schicken an ihre Opfer eine Phishing-Nachricht und geben vor, das Gerät der Opfer müsste für den Log-in ins Microsoft-365-Konto neu autorisiert werden. Die Nachrichten beginnen meist harmlos, etwa mit „Ihre Sitzung ist abgelaufen“, und bieten einen Link zur Neuanmeldung. Wenn das Opfer dem Link in der Nachricht folgt, landet es zunächst auf einer gefälschten Website, schließlich aber beim offiziellen Microsoft-Authentifizierungsverfahren für Geräte und Anwendungen (Oauth-Device-Code-Flow).

Proofpoint

Es handelt sich um echte Microsoft-Meldungen und Webseiten. Allerdings autorisiert das Opfer nicht den Zugang zu seinem eigenen PC oder Smartphone, sondern eine Anwendung der Kriminellen. Diese bekommen nach der Freigabe durch das getäuschte Opfer einen Access-Token. Damit kann die feindliche Anwendung per API auf das Microsoft-Konto zugreifen, ohne dass noch einmal ein Passwort eingegeben werden muss.

Übrigens: Die meisten dieser Angriffe verstecken den Link zur gefälschten Website in einem QR-Code. Dieser entgeht den Spam-Filtern eher als ein üblicher Link, und es lässt die meisten Opfer vom PC auf das Smartphone wechseln.

Auf diesem ist es wegen des kleineren Bildschirms und oft fehlender Sicherheits-Software noch wahrscheinlicher, dass das Opfer die Täuschung nicht bemerkt. Eine ausführliche Analyse der Angriffe auf Microsoft-365-Konten haben die Sicherheitsexperten von Proofpoint veröffentlicht.

2. Support-Masche: Ihr Computer ist gesperrt & Co.

Die Support-Masche ist zwar nicht neu, funktioniert aber nach wie vor: Noch immer fallen zahlreiche Menschen auf die perfide Betrugsstrategie herein. Zu den prominenten Opfern zählt Bundestagspräsidentin Julia Klöckner.

Mutmaßlich staatlich organisierte Angreifer kontaktierten sie über den Messenger-Dienst Signal und gaben sich als vermeintliche Signal-Support-Mitarbeiter aus. Unter einem Vorwand forderten sie Klöckner und weitere Politiker auf, ihre PIN einzugeben. Dadurch erlangten die Angreifer Zugriff auf die Signal-Konten der Betroffenen – und damit auf private Chats und Kontakte.

Das Bundesamt für Verfassungsschutz und das Bundesamt für Sicherheit in der Informationstechnik (BSI) haben gemeinsam einen Leitfaden veröffentlicht, der potenziellen Opfern hilft zu prüfen, ob ihr Signal-Konto übernommen wurde.

Bundesnetzagentur

Ebenfalls weiterhin verbreitet sind Angriffe durch angebliche Microsoft-Support-Mitarbeiter. Die Betrüger kontaktieren ihre Opfer per Telefon, E-Mail oder über gefälschte Pop-up-Warnungen im Browser.

Dabei behaupten sie, der Windows-PC habe ein Sicherheitsproblem – etwa sei der Computer gesperrt oder mit Schadsoftware infiziert. Anschließend versuchen sie, die Betroffenen zur Installation einer Fernwartungssoftware oder eines vermeintlichen Sicherheitstools zu bewegen. Tatsächlich erhalten die Angreifer dadurch oft vollständigen Zugriff auf den Rechner.

3. Gefälschter Microsoft Defender warnt

Der Microsoft Defender ist ein Windows-Bordmittel und schützt PCs gegen alle bekannten PC-Viren. Entsprechend alarmierend ist für viele Nutzer eine Warnung dieses Antiviren-Tools. Eine gefälschte Form dieser Warnung erscheint mal per E-Mail, mal als Pop-up im Browser. In diesen Nachrichten wird behauptet, der Schutz des Defenders müsse kostenpflichtig erneuert werden. In der Folge werden die Nutzer auf gefälschte Shop-Webseiten geleitet, die eine Zahlung für einen Virenschutz verlangen.

Grundsätzlich gilt: Der Microsoft Defender ist auf Privat-PCs ein Bordmittel und kostenlos in Windows enthalten. Eine Zahlung ist nicht nötig. Sollte die Warnung per Mail bei Ihnen landen, löschen Sie diese einfach. Schlägt sie als Pop-up im Browser auf, schließen Sie einfach das Browser-Fenster, notfalls mit der Tastenkombination „Alt+F4”.

Der Antivirenspezialist Norton hat eine Anleitung veröffentlicht, die erklärt, wie sich solche Pop-up-Warnungen im Browser beseitigen lassen, falls sie sich im System festgesetzt haben.

4. Microsoft-Onedrive: Cloud-Phishing über Freigaben

Cloud-Dienste wie Onedrive von Microsoft nutzen viele Windows-Nutzer mehrmals täglich. Genau deshalb sind sie ein attraktives Ziel für Phishing. Statt klassischer E-Mails mit Dateianhängen erhalten die Nutzer Freigabe-Benachrichtigungen mit einem Betreff wie „Dokument wurde mit Ihnen geteilt“. Der Inhalt wirkt meist harmlos und oft beruflich relevant: Rechnungen, Projektpläne, Gehaltslisten oder interne Dokumente.

Besonders tückisch ist die Kombination aus echten und gefälschten Elementen. Manche Angriffe nutzen tatsächlich legitime Cloud-Plattformen, bieten dort aber manipulierte Dokumente an. Das Ziel dieser Angriffe sind mehrheitlich die Log-in-Daten der Opfer zu Ihren Cloud- und Mail-Konten. Diese werden dann von den Angreifern übernommen und etwa für neue Phishing-Attacken genutzt.

5. Lieferdienste, Lieferdienste und noch mal Lieferdienste

Phishing im Namen von Paketdiensten gehört zu den stabilsten Angriffsmustern überhaupt und wird gleichzeitig immer ausgefeilter. Der Grund ist die hohe Alltagstauglichkeit: Fast jeder erwartet regelmäßig Lieferungen und ist deshalb kaum misstrauisch, wenn eine Mail, SMS oder Whatsapp zum Thema Paketversand eintrudelt. Moderne Varianten enthalten nicht nur einfache Textlinks, sondern vollständige Tracking-Systeme.

Arne Arnold

Diese Seiten sind dynamisch aufgebaut und simulieren echte Logistikprozesse. Beim Sendungsverlauf heißt es dann etwa: „Zustellung fehlgeschlagen – bitte Adresse bestätigen“ oder „Letzte Möglichkeit zur Terminänderung“. Besonders kritisch ist die Kombination aus Zeitdruck und Kontext. Wer Opfer eines solchen Angriffs wird, gibt meist seine Log-in-Daten für Shopping- oder Zahlungsdienste preis. Oder er überweist den Angreifern direkt Geld, da angeblich Steuern, Bearbeitungsgebühren oder ein Expresszuschlag fällig sind.

Arne Arnold

Übrigens: Ab dem 1. Juli 2026 gibt es zusätzliche Abgaben auf Sendungen aus Nicht-EU-Ländern. Für Waren unter 150 Euro sind dann pauschal 3 Euro Zollgebühr und eine Einfuhrumsatzsteuer fällig. Einige Kurierdienste verlangen zusätzlich eine Servicepauschale für diese Zollanmeldung. Über die genauen Kosten informiert eine Seite der Verbraucherzentrale NRW. Es lohnt sich, die tatsächlichen Kosten zu kennen, denn es ist wahrscheinlich, dass zu diesem Termin vermehrt Phishing-Mails zu diesem Thema versendet werden.

6. Phishing zu Online-Banking gibt es immer

Phishing zum Online-Banking gibt es fast schon so lange wie das Online-Banking selbst. Die Bedrohungslage ist aber so angespannt wie nie, denn die Angriffe sind nun wirklich zahlreich. Über die neuesten Phishing-Fallen informieren unter anderem die Verbraucherzentralen.

Beispiele aus dem Mai 2026 lauten etwa so: „Bestätigung Ihrer Mobilfunknummer erforderlich“. Absender ist vorgeblich die Easybank. Eine Fälschung von Commerzbank-Mails warnt vor einem fälligen „Photo-TAN Update“, bei dem ein „einmaliger Abgleich der Zugangsdaten“ nötig ist.

Andere Phishing-Mails geben vor, von der Deutschen Bank zu sein, und fordern eine Reaktivierung des „photoTAN-Sicherheitszertifikats“. Auch Kunden der DKB erhielten im Mai Phishing-Mails.

Verbraucherzentrale

Sollten Sie eine Mail von Ihrer Bank bekommen, klicken Sie auf keinen Fall auf einen der Links in dieser Mail. Wenn Sie sich unsicher sind, ob Sie reagieren sollen, rufen Sie die Website Ihrer Bank über Ihren Browser auf.

Sollte es tatsächlich ein Anliegen der Bank geben, wird es Ihnen nach dem Einloggen in Ihr Online-Konto angezeigt. Oder Sie rufen Ihre Bank einfach per Telefon an und fragen, ob Informationen von Ihnen benötigt werden.

7. Phishing per Post: Kreditbetrug per Postident-Verfahren

Diese Phishing-Angriffe erreichen Sie per Post in Ihrem echten Briefkasten. Die Briefe geben vor, von Ihrer Bank zu stammen, und fordern Sie auf, Ihre Daten erneut per Postident zu bestätigen. Postident ist ein Verfahren der Post, mit dem Sie Ihre Identität gegenüber anderen, etwa einer neuen Bank oder einem Kreditinstitut, bestätigen können. Wer das beigefügte Schreiben nutzt, legitimiert in der Regel einen hohen Kredit bei einer anderen Bank.

Schäden von 15.000 bis 25.000 Euro sind hier keine Seltenheit. Vorangegangen ist meist ein Diebstahl Ihrer genauen Daten (Postadresse, Hausbank, Arbeitgeber, Verdienst), den die Angreifer dann nutzen. An die Daten kommen die Kriminellen etwa über gefälschte Wohnungsinserate bei Immoscout24 oder ähnlichen Portalen. Wer sich auf eine Wohnung oder ein Haus mit Gehaltszetteln und weiteren Angaben bewirbt, hat bereits alle wichtigen Daten für den Postident-Betrug verraten. Seien Sie beim Postident-Verfahren stets besonders vorsichtig. Konkrete Tipps lesen Sie hier.

Sicherheitstipps: Phishing erkennen und blockieren

An diesen Merkmalen erkennen Sie betrügerische Nachrichten:

• Unverlangter Kontakt: Sie erhalten eine E-Mail, Whatsapp oder SMS über eine Gutschrift, eine Lastschrift oder andere finanzielle Ansprüche, obwohl Sie aktuell keine Buchung storniert oder reklamiert haben.
• Zeitdruck: Die Nachricht suggeriert dringenden Handlungsbedarf und fordert zur schnellen Reaktion auf.
• Verdächtige Links: Die Links in der Nachricht sind hinter einem QR-Code maskiert, führen zu unpassenden Domains oder sind ungewöhnlich lang.
• Aufforderung zur Dateneingabe: Seriöse Unternehmen fordern in Nachrichten oder Mails nur äußerst selten zur Eingabe sensibler Daten auf.
• Unpersönliche Anrede: Oft fehlt die namentliche Ansprache oder es werden generische Formulierungen verwendet.

Diese Maßnahmen schützen vor Phishing-Fallen:

• E-Mail, SMS und Whatsapp & Co. sind keine geschlossenen Nachrichtenkanäle: Sie müssen damit rechnen, auch betrügerische Nachrichten zu erhalten.
• Misstrauen Sie Links in Nachrichten: Klicken Sie keine Links an und scannen Sie keine QR-Codes, wenn Log-in-, Zahlungs- oder Sicherheitsaufforderungen in der Mail stehen. Öffnen Sie den jeweiligen Dienst im Browser über die manuelle Eingabe der Adresse.
• Nutzen Sie Browser und Passwortmanager als Frühwarnsystem: Wenn Ihr Passwortmanager Ihre Log-in-Daten auf einer Webseite nicht einfügen möchte, dann ist die Domain vermutlich gefälscht. Achten Sie zudem auf die Warnungen Ihres Browsers.
• MFA aktivieren: Nutzen Sie immer eine Zwei- oder Multifaktor-Authentifizierung, wenn diese angeboten wird. Vor allem Passkeys erhöhen die Sicherheit.
• Remote-Support misstrauen: Installieren Sie keine Fernwartungs-Tools, nachdem Sie unaufgefordert kontaktiert wurden.
• Freigaben hinterfragen: Wenn Sie Freigaben für Dateien in Cloud-Speichern erhalten, kontaktieren Sie zunächst den Absender, idealerweise telefonisch.

Infos zu aktuellen Angriffen: Informieren Sie sich über Phishing-Kampagnen etwa bei der Verbraucherzentrale NRW.

Als letzte Verteidigungslinie lassen sich Antivirenprogramme, Browserschutz und Spezial-Tools einsetzen:

• Antivirus: Große Sicherheits-Suiten wie G Data Internet Security filtern Phishing-Mails heraus, bevor sie diese Nachrichten öffnen.
• Browser-Schutz: Browser von Sicherheitsanbietern blockieren viele aktuelle Phishing-Seiten, etwa der KI-Browser Norton Neo.
• Spezial-Tools: KI-Chatbots wie Scamio von Bitdefender begutachten verdächtige Nachrichten und warnen vor gefährlichen Inhalten.

Arne Arnold

Ich weiß nicht, wie es in Ihren Schubladen aussieht, aber meine sind voll mit Kabeln, die ich wahrscheinlich nie wieder benutzen werde, weil die Technologie sich ziemlich weiterentwickelt hat. Zum Glück scheint sich USB-C durchzusetzen, denn es gibt keinen falschen Weg, diese Dinger anzuschließen. Aber nicht nur Smartphones, Tablets und Laptops verwenden diese Anschlüsse, sondern auch eine lange Liste von Gadgets.

Wir haben den Markt nach versteckten Perlen durchforstet: Gadgets, bei denen Sie denken werden: “Wow, ich wusste gar nicht, dass ich das brauche, aber es wird mein Leben so viel einfacher machen!” Schauen wir uns also an, mit welchen coolen Geräten Sie Ihre Typ-C-Kabel und -Anschlüsse nutzen können.

heat it Insektenstichheiler

PCWelt/heat it/Amazon

Wer im Sommer oder Urlaub oft von Mücken geradezu heimgesucht wird, wird sich besonders über dieses geniale Gadget freuen: Dieses winzige Gerät, das sich einfach per USB-C mit Ihrem Smartphone verbinden lässt, kann mit gezielter Wärme den Juckreiz von Stichen und Insektenbissen deutlich reduzieren.

Ähnlich wie größere Varianten, etwa diesen hier von Beurer, muss man den kleinen Stichheiler von heat it einfach nur per App aufladen und dann auf den Stich halten. Die Hitze erledigt dann den Rest und zersetzt die Proteine, die im Mückenstich dafür sorgen, dass die Stelle anschwillt, juckt und schmerzt. Ein echtes Must-have für den Sommer, und es kostet nicht mal 25 Euro.

Mini-Ventilator

KIMMOO / Amazon / PC-WELT

Ziemlich genial sind auch diese kleinen Ventilatoren, die man im Sommer einfach in der Hosentasche mitnehmen und bei Bedarf schnell einsetzen kann. Wer schon einmal bei 30 Grad in einer vollen S-Bahn saß und sich zumindest ein wenig frische Luft gewünscht hat, der wird dieses Gadget lieben.

Der Mini-Ventilator für unter 20 Euro mit USB-C-Ladeanschluss kann ganz einfach über Powerbanks, Computer, Laptops oder USB-Ladegeräte betrieben werden. Es gibt aber noch kleinere und günstigere Ventilatoren, die man direkt ans Handy anschließen kann, und gerade mal 2-3 Euro pro Stück kosten. Diese sorgen aber auch für einen weniger starken Luftstrom, daher würden wir eher die erste Variante empfehlen.

USB-C zu HDMI Adapter

Anker

Wenn Ihr Laptop über einen USB-C-Anschluss verfügt, Sie Ihren Monitor aber schon seit Ewigkeiten nicht mehr geupgradet haben, verfügt Ihr Bildschirm vermutlich nicht über einen Typ-C-Anschluss. Dieser Adapter von Anker löst dieses Problem für Sie, sodass Sie das normale HDMI-Kabel, das Sie an Ihren Monitor anschließen, mit diesem Gerät verbinden können.

Der Adapter unterstützt Auflösungen von bis zu 4K bei 60 Hz, was ziemlich beeindruckend ist. Dies ist auch eine raffinierte Möglichkeit, Ihr Smartphone oder Tablet an Ihren Monitor oder Fernseher anzuschließen. Das Gerät kostet circa 13 Euro, aber wir haben es schon für nur 13 Euro bei Amazon gesehen.

Mini-Schraubendreher

Amazon

Wenn Sie häufig an Ihrem Computer oder anderen Geräten herumschrauben müssen, ist dieser elektrische Mini-Schraubendreher vielleicht genau das Richtige für Sie. Dieser stiftförmige Schraubendreher verfügt über vier LED-Leuchten, damit Sie besser sehen können, woran Sie gerade arbeiten, und dreht sich 200 Mal pro Minute, sodass Sie die Arbeit schneller erledigen können.

Der Schraubendreher verfügt über 64 verschiedene Aufsätze, es sollte also für so gut wie jeden Einsatzzweck ein passender dabei sein. Er kann über USB-C aufgeladen werden und hält bis zu drei Stunden lang. Der Elektroschraubendreher kostet normalerweise 41 Euro, ist aber auch für 32 Euro im Angebot erhältlich.

USB-C microSD-Kartenleser

Ugreen / Amazon

Die meisten Laptops verfügen heutzutage nicht mehr über einen Kartenleser, daher muss man andere Wege finden, um Daten von diesen kleinen Dingern zu übertragen. Egal, ob Sie Daten von der Karte Ihrer Dashcam oder Ihrer Kamera übertragen möchten, dieser winzige Ugreen USB-C microSD-Kartenleser ist dafür bestens geeignet.

Der Kartenleser ist so klein, dass Sie ihn wahrscheinlich an einem Schlüsselbund befestigen können. Wenn Sie eine etwas vielseitigere Version bevorzugen, bietet Ugreen ein Modell an, das auch mit SD-Karten kompatibel ist und sowohl über USB-C- als auch USB-A-Anschlüsse verfügt. Alle diese Modelle kosten weniger als 10 Euro und sind daher eine lohnende Investition.

Anker Nano Power Bank

Anker

Eine Sache, die Sie unbedingt in Ihrer Tasche, Reisetasche oder in Ihrem Rucksack haben müssen, ist eine Powerbank. Denn man weiß schließlich nie, wann das Telefon einen mal im Stich lässt und nach einer Aufladung schreit. Die Anker Nano Power Bank ist zum Glück so klein, dass sie fast überall hinpasst.

Sie verfügt über einen faltbaren USB-C-Anschluss und einen Anschluss an der Seite, sodass Sie bei Bedarf zwei Geräte gleichzeitig aufladen können. Die Kapazität von 5.000 mAh reicht gerade aus, um Ihr Handy einmal vollständig aufzuladen, was in der Not entscheidend sein kann. Außerdem kostet sie gerade mal 26 Euro, ist aber immer wieder mal reduziert.

Endoskopkamera mit Licht

Ennovor

Auch wenn Sie diese Endoskopkamera von Ennovor nicht jeden Tag benutzen werden, kann sie doch sehr nützlich sein. Sie schließen sie einfach an Ihr Telefon an, installieren eine App und sehen alles, was Ihre Kamera macht. Mein Kollege schwört darauf und verwendet sie, um alles zu finden, was so hinter dem Schreibtisch verloren geht.

Gerade dann, wenn Sie am Auto arbeiten oder nach undichten Leitungen suchen, ist das Teil super nützlich. Da sie die Schutzklasse IP67 hat, können Sie sie sogar in Ihr Aquarium stellen. Die Kamera wird mit einem circa 5 Meter langen, halbstarren Kabel und diversem Zubehör geliefert, darunter ein Haken, ein Magnet und ein Spiegel. Sie können diese Kamera im Moment für um die 22 Euro kaufen.

Blukar Taschenlampe

Blukar

Egal, wer Sie sind oder wo Sie so unterwegs sind: Sie brauchen eine Taschenlampe. Je kleiner, desto besser, denn so können Sie sie in jede Tasche stecken. Dieses Modell von Blukar verfügt über einen eingebauten 1800mAh-Akku, den Sie mit einem der vielen Typ-C-Kabel aufladen, die Sie so herumliegen haben.

Mit einer einzigen Ladung können Sie bis zu 16 Stunden arbeiten, was ziemlich gut ist. Sie können zwischen vier verschiedenen Blitzmodi wählen, darunter auch einer, der Ihnen hilft, Hilfe zu signalisieren. Außerdem kostet die kleine Taschenlampe weniger als 10 Euro. Es gibt also keine Ausrede, sich diesen Tipp entgehen zu lassen.

Samsung Flash-Laufwerk

Samsung

Die allermeisten Flash-Laufwerke haben einen USB-A-Anschluss, aber dieses von Samsung besitzt einen Typ-C-Anschluss. Mit Übertragungsgeschwindigkeiten von bis zu 400 MB/s können Sie Dateien im Handumdrehen verschieben. Das Coole an diesem USB-Stick ist, dass Sie ihn sogar in Ihr Smartphone stecken können, um 4K-Videos direkt darauf aufzunehmen.

Das Samsung Type-C Flash-Laufwerk ist in verschiedenen Speicheroptionen erhältlich, angefangen bei 64 GB bis hin zu 512 GB.

Mini Luftpumpe

PCWelt/Cycplus/Amazon

Ebenfalls perfekt für den Sommer geeignet ist diese kleine Luftpumpe von Cycplus, die unterwegs in jede Tasche passt. Sie kann nicht nur einen Fahrradreifen innerhalb von zwei Minuten auf Knopfdruck wieder aufpumpen, sondern wird auch per USB aufgeladen. Sie eignet sich laut Hersteller für Mountainbikes, Rennräder, Motorräder und sogar Autos!

Neben der Luftpumpe selbst lässt sich dieses praktische Gadget auch als Taschenlampe oder Powerbank für unterwegs einsetzen. Alles Dinge, die man auf einer Fahrradtour sehr gut gebrauchen kann. Und für den Preis von nur 45,99 Euro wirklich empfehlenswert, wenn Sie schnelle Hilfe bei platten Reifen benötigen. Im Angebot kostet sie sogar nur 37 Euro.

Leselampe mit Buchklemme

Gritin / Amazon

Wer auch gerne und viel liest, und das teilweise bis spät in die Nacht hinein, wird sich über dieses kleine Teil hier freuen: eine Leselampe, die Sie einfach an Ihr Buch klemmen können. Das ist jetzt vielleicht nichts bahnbrechend Neues, doch mit insgesamt drei Farbtemperaturen und fünf verschiedenen Lichtmodi können Sie individuell anpassen, wie viel Licht Sie zum Lesen brauchen.

Die Leselampe von Gritin kostet bei Amazon gerade mal 13 Euro und besitzt einen 1200-mAh-Akku, der je nach Nutzung bis zu 80 Stunden durchhält. Danach können Sie ihn einfach per USB wieder aufladen. Den Hals der Lampe können Sie nach Belieben hin- und herschwenken, und es gibt sogar eine kleine Ladeanzeige. Was will man mehr?

Externes DVD-Laufwerk

Amicool

Wenn Ihr Laptop wie viele heutzutage kein DVD-Laufwerk besitzt, dann wird Ihnen dieses kleine Gerät sehr nützlich sein. Dieses externe DVD-Laufwerk von Amicool wird über USB-C (oder USB-A) an Ihren Laptop angeschlossen und bietet Ihnen das optische Laufwerk, das Sie manchmal benötigen.

Es kann DVDs und CDs problemlos lesen und brennen, sodass Sie Software installieren, Dateien kopieren, Daten sichern, Spiele spielen und vieles mehr können. Sie müssen nicht einmal Treiber installieren, da dieses Gerät Plug-and-Play-fähig ist. Normalerweise kostet es 28 Euro, aber oft ist es schon für etwa 20 Euro zu haben, was ein absolutes Schnäppchen ist.

Wiederaufladbare Handwärmer

Amazon / PC-WELT

Wenn es langsam wieder kälter wird, wünscht man sich oft nichts sehnlicher, als seine Hände etwas schneller aufwärmen zu können. Das geht natürlich auch mit Handschuhen oder einer Tasse Tee, doch diese Handwärmer für 20 Euro sind nicht nur wiederaufladbar, sondern halten Ihre Finger mit einer einzigen Ladung auch bis zu 24 Stunden lang warm.

Die beiden Gadgets verfügen über einen Temperatursensor-Chip, mit dem Sie eine von drei Temperaturen für eine präzise Steuerung auswählen können. Außerdem stehen verschiedene Farben zur Auswahl, wodurch sie sich auch bestens als Geschenk eignen.

Können Geräte keine Verbindung zum WLAN herstellen oder läuft die Datenübertragung plötzlich lediglich noch im Schneckentempo, ist die Ursache oftmals schwer zu bestimmen. Der Fehler kann an veralteten oder beschädigten Treibern liegen, an einem überlasteten oder falsch konfigurierten Router, an Störsignalen durch benachbarte Funknetze oder daran, dass der Client zu weit vom Router entfernt ist.

Um sich einen Überblick über den WLAN-Status zu verschaffen und damit diese Probleme zu lösen, bringt Windows ein spezielles Tool mit: Es liefert Ihnen in Sekundenschnelle eine Übersicht zu Ihrem Netzwerk. Hierzu benötigen Sie die Kommandozeile oder Powershell: Starten Sie das gewünschte Eingabeprogramm, indem Sie in der Taskleiste in das Suchfeld Eingabeaufforderung oder Power shell eingeben.

Achten Sie darauf, dass der Treffer markiert ist und klicken Sie dann auf der rechten Seite auf „Als Administrator ausführen“. In der Eingabeaufforderung tippen Sie den Befehl netsh wlan show wlanreport ein und bestätigen mit Enter. Windows erzeugt nun den WLAN-Bericht und speichert ihn in der Datei „wlan-report-latest.html“ in dem Ordner „C:\ProgramData\Microsoft\Windows\WlanReport“.

Foundry

Am besten markieren Sie diesen Pfad direkt in der Eingabeaufforderung mit der Maus und übernehmen ihn mit Strg-C in die Zwischenablage. Öffnen Sie danach das Suchfeld in der Taskleiste, kopieren Sie den Pfad mit Strg-V hinein und bestätigen Sie mittels Enter. Windows ruft nun Ihren Standardbrowser auf und lädt die HTML-Datei des Berichts. Falls das nicht funktioniert, steuern Sie den Ordner über den Explorer an.

Allerdings ist das Verzeichnis in den Standardeinstellungen versteckt – Sie müssen es zunächst über die Einstellungen des Explorers sichtbar machen. Klicken Sie anschließend doppelt auf die HTML-Datei, um sie im Browser zu öffnen. Im Bericht sehen Sie ganz oben eine Übersicht der WLAN-Ereignisse der letzten 48 Stunden. Sie können über einzelne Verbindungen mit der Maus fahren, um Details einzusehen.

Die Ereignisse sind mit farbigen Punkten und Buchstaben gekennzeichnet: Ein schwarzes X auf rotem Grund steht beispielsweise für einen Fehler, N zeigt an, dass die Verbindung zu einem WLAN unterbrochen wurde. Weiter unten finden Sie bei „Report Info“ das Datum, an dem der Bericht erzeugt wurde, sowie die Berichtsdauer.

Foundry

Darunter folgt die „General System Info“, die Details zur Hardware, zum Bios und zur Windows-Version verrät. Diese Daten können beispielsweise bei Kompatibilitätsproblemen helfen. Der Abschnitt „User Info“ nennt einige grundlegende Benutzerdaten:

Darunter finden Sie bei „Network Adapters“ die installierten Netzwerkadapter, und zwar sowohl den oder die Hardwareadapter sowie Softwareadapter, beispielsweise für eine VPN-Verbindung oder für Bluetooth und virtuelle Adapter. Bei „Script Output“ beginnt die Anzeige der Ausgabebildschirme von einigen Troubleshooting-Tools in Windows.

So liefert der Befehl ipconfig /all zum Beispiel Angaben zur aktuellen Netzwerkkonfiguration sämtlicher Adapter. Das Kommando netsh wlan show all ermittelt Daten zu den installierten Netzwerktreibern, Details zu Ihrem WLAN und den in der Vergangenheit genutzten Access Points.

Foundry

Darüber hinaus führt Windows für den Bericht den Befehl certutil aus, der Ihnen weitere Einzelheiten über die verschiedenen WLAN-Profile präsentiert. Weiter unten folgt im Bereich „Summary“ ein Überblick über die erfolgreichen und die gescheiterten WLAN-Verbindungen. Dort nennt der Bericht auch die Gründe, warum beispielsweise der Kontakt zu einem WLAN verlorengegangen ist.

Diese Informationen sind oft besonders hilfreich, wenn es um die Fehlersuche im Netzwerk geht. Ganz am Schluss des Berichts steht der Abschnitt „Wireless Sessions“: Dort sind den WLAN-Adaptern unter anderem Informationen zur Verbindungsmethode und der SSID des WLAN zugeordnet. Des Weiteren stehen an dieser Stelle die Event-IDs und Beschreibungen der Ereignisse beim Aufbau der Verbindung.

Auch daraus lassen sich Schlussfolgerungen für die Lösung von Verbindungsproblemen ziehen.

Lesetipp: Die besten Tools für WLAN & Heimnetz

The post How to Build an End-to-End OCR Pipeline with Baidu’s Unlimited-OCR for High-Resolution Images and Multi-Page PDF Parsing appeared first on MarkTechPost.

We recommend to read this FAQ before using a pre-release in a production environment.

Please use the attached archives for installing or updating Matomo.
The source code download is only meant for developers and will require extra work to install it.

• Latest stable production release can be found at https://matomo.org/download/ (learn more) (recommended)
• Beta and Release Candidate releases can be found at https://builds.matomo.org/ (learn more)

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Daniel Yip

Google Chrome

Read more →

The post Windows 11 Security Cheat Sheet: BitLocker, Passkeys, and Defender Explained appeared first on IT Security News.

This video is sponsored by NetworkChuck Coffee. Grab a bag of Default Route (my favorite) and fuel your next build: https://ntck.co/coffee

Raspberry Pi sent me the new Raspberry Pi Touch Display 2, the 10 inch portrait version, and I mounted it on my studio wall to run all my Home Assistant and homelab stuff. It is a gorgeous little screen (1200x1920, real IPS, 10 finger touch, 400 nits) and at $80 it is a steal. There is one catch though, and a lot of you are not going to like it: this thing only works on the Raspberry Pi 5 and the Compute Modules. Your Pi 3 or Pi 4 will not work at all.

In this video I unbox it, walk through everything that is new versus the old touch display, hit a wall when it powered on and did absolutely nothing (turns out you have to update the firmware on your Pi 5, the EEPROM, before it will recognize the screen), mount it with nothing but a drill and some screws, and finally turn it into a beautiful Home Assistant dashboard using an open source kiosk app called TouchKio. Whether you are building a smart home wall panel, a homelab status board, or you just want your Raspberry Pi to show off what it is doing, this is a really good option.

Join the NetworkChuck Academy!: https://ntck.co/NCAcademy

RESOURCES / LINKS:
🌐 Raspberry Pi Touch Display 2: https://www.raspberrypi.com/products/touch-display-2/
🛠️ TouchKio (open source kiosk app): https://github.com/leukipp/touchkio
🏠 Home Assistant: https://www.home-assistant.io/
🖥️ Proxmox: https://www.proxmox.com/
📖 Update your Raspberry Pi firmware (EEPROM): https://www.raspberrypi.com/documentation/computers/raspberry-pi.html
☕ NetworkChuck Coffee (Default Route): https://ntck.co/coffee

TIMESTAMPS:
0:00 - Unboxing the new Raspberry Pi Touch Display 2
0:45 - What is new on the 10 inch portrait display
1:50 - The catch: Raspberry Pi 5 and Compute Modules only
2:48 - It powered on and nothing happened
3:16 - The fix: updating your Raspberry Pi 5 firmware
5:55 - Building the Home Assistant dashboard with TouchKio

**Raspberry Pi provided the Touch Display 2 for this video, no strings attached. All opinions are my own.

SUPPORT NETWORKCHUCK:
☕☕ COFFEE and MERCH: https://ntck.co/coffee

READY TO LEARN??
🔥🔥Join the NetworkChuck Academy!: https://ntck.co/NCAcademy
📚 CCNA Course: https://ntck.co/ccna

FOLLOW ME EVERYWHERE:
Instagram: https://www.instagram.com/networkchuck/
X/Twitter: https://x.com/networkchuck
Facebook: https://www.facebook.com/NetworkChuck/
Join the Discord server: https://ntck.co/discord

Some links in this description are affiliate links. If you buy through them, I may earn a small commission at no extra cost to you.

#raspberrypi #homeassistant #homelab

The post Windows 11 Security Cheat Sheet: BitLocker, Passkeys, and Defender Explained appeared first on TechRepublic.

Passwords and traditional MFA remain common targets for phishing and credential theft. FalconID extends phishing-resistant, FIDO2-based passkeys to third-party applications, enabling secure, passwordless authentication across platforms like Entra ID, Okta, GitHub, and Salesforce.

Passkeys are device-bound, centrally managed through the Falcon console, and continuously protected by Falcon security signals—allowing organizations to revoke access instantly when risk changes.

🛡️ Falcon ID
Learn more here: https://cs.link/urLrS

📣 Connect With Us:

► X:
https://twitter.com/CrowdStrike
► Instagram:
https://www.instagram.com/crowdstrike
► LinkedIn:
https://www.linkedin.com/company/crowdstrike

🔔 Subscribe to stay updated!

#CrowdStrike #Cybersecurity

This wave of VentureBeat Pulse Research examines enterprise agent orchestration: which platforms enterprises run on, what drives the choice, what they optimize for, how they expect agent control to be structured, and — most revealingly — how orchestrated their deployed “agents” actually are and how tightly they control the cost of running them.

The central finding is a gap between orchestration ambition and orchestration reality. Enterprises are consolidating fast onto the major model platforms: Anthropic’s Claude is the primary platform for 40%, more than double any rival, followed by Microsoft (18%) and OpenAI (13%). The choice is driven by “model gravity” — native alignment with a state-of-the-art base model (21%) — and success is judged by reliable, multi-step execution (task completion reliability 32%, multi-step workflow management 28%). Yet asked to assess their portfolios honestly, 71% say a quarter or fewer of their deployed “agents” are true multi-step orchestrated workflows rather than single-prompt chatbot wrappers, and only 10% have crossed the halfway mark. The orchestration layer is being built well ahead of the orchestrated portfolio it is meant to run.

That gap shapes the architecture enterprises are putting in place. By the end of 2026 a clear majority (51%) expect a hybrid control plane — provider-native plus external orchestration — and only 6% expect to hand control to a provider-managed service, because vendor lock-in (35%) is the risk they fear most if control lives inside a model provider. Investment follows the build-out: agent workflow tooling leads the spend (34%), with security and permissions enforcement (25%) behind. And fiscal control lags throughout — more than a quarter (27%) have no real-time way to stop a runaway agent before the bill arrives.

Methodology

VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent orchestration. Responses are filtered to organizations with 100 or more employees (n=101), drawn from a single June 2026 wave; because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends.

By organization size the sample is spread evenly across the enterprise bands: 100–499 employees, 2,500–9,999, and 50,000+ (21% each), with 10,000–49,999 and 500–2,499 (19% each). By role it is senior and buyer-credible: product and program managers (15%), CIO/CTO/CISO (13%), consultants and advisors (13%), and a spread of data, AI, and engineering directors and VPs, with an “Other” function at 18%. On purchasing, 81% are recommenders, influencers, or final decision-makers for AI solutions (66% recommender/influencer, 15% final decision-maker). Technology/Software is the largest industry at 44%, followed by Financial Services (17%) and Healthcare/Life Sciences (8%).

At 101 respondents the sample is robust enough to read directionally with reasonable confidence, though it remains self-selected and is not a probability sample.

Finding 1: Orchestration runs on model-provider platforms

Anthropic’s Claude leads; open frameworks are marginal

We asked which agent orchestration platform enterprises primarily use today. The answer concentrates on the major model providers — and on one in particular.

A note on reading these shares. As described in the methodology section, the respondents are self-selected, and this question asked them for a single primary platform — so the figures measure which platform leads each enterprise's deployment, within a self-selected audience of AI-active technical decision-makers. A sample built this way can diverge substantially from spend-weighted market measures, and each VB Pulse survey draws its own sample with its own company-size mix, so vendor figures should not be compared across our surveys either. Read these shares as a portrait of where this cohort has placed its primary orchestration bet today, rather than as market share.

The model platforms dominate. Anthropic, Microsoft, OpenAI, Google, and Amazon together account for roughly 80% of deployments (81 of 101), while the open frameworks (LangChain/LangGraph) and custom in-house builds that anchor engineering discussion sit in single digits. Anthropic’s lead — 40%, more than double the next platform — mirrors the “model gravity” selection logic in Finding 2: enterprises are choosing the orchestration layer that comes with the model they want to build on. As with the security vendors in the prior agent-security wave, the tools that define the category in technical circles are not yet where enterprise deployment concentrates. A small 3% are not orchestrating at all.

Respondents rate the platforms they run at 3.94 out of 5 overall (109 answered), with “value for money” specifically at 3.94 and “ease of implementation” the weakest score, at 3.85 — placing orchestration near the bottom of our five-tracker satisfaction range, ahead of only evaluation tooling. A rating just under 4 out of 5, from users of whom 96% plan to change their orchestration approach within the year, reads as provisional acceptance: the platforms work well enough to run today, and not well enough to stop the search for something better. The ratings sit alongside near-universal intent to change; this is a layer enterprises tolerate more than they love.

Finding 2: Model gravity drives platform selection

The base model, not the tooling, decides the platform

We asked what most influenced the orchestration platform choice. The single largest factor is the pull of the underlying model — though flexibility and ease of development follow close behind.

Model gravity leading is the selection-side explanation for Anthropic’s platform lead: enterprises pick the orchestration environment closest to the frontier model they have standardized on. But the next tier complicates the picture — flexibility across models and tools (17%) and ease of development (17%) say enterprises also want to avoid being trapped by that choice, foreshadowing the lock-in fear in Finding 6. Security and permissions (14%) and total cost of ownership (11%) round out a pragmatic buying logic. Performance (latency/memory) sits last at 4%, a reminder that at this stage of adoption the binding constraints are model fit and optionality, not raw speed.

Finding 3: The job is reliable multi-step execution

Enterprises just orchestration by whether it completes the work

We asked what enterprises optimize for — their primary success metric for orchestration. Reliability and multi-step workflow management dominate; developer- and user-facing metrics trail.

Task completion reliability (32%) and multi-step workflow management (28%) together account for 59% of responses (60 of 101): orchestration succeeds, in the enterprise view, when it reliably carries a task through multiple steps to completion. Developer productivity (17%) matters but is secondary — the inverse of its prominence in framework discussion — and end-user experience (9%) is a minor concern, consistent with orchestration being an internal execution problem rather than a UX one. This reliability-first standard is exactly what makes the Chatbot Trap finding so pointed: enterprises define success as dependable multi-step execution, yet most of their deployed “agents” do not yet do multi-step work at all.

The trap is not evenly distributed. Splitting the sample by organization size, 77% of smaller enterprises say a quarter or fewer of their agents do true multi-step work, against 62% of larger ones. Larger enterprises are meaningfully further into genuine multi-step deployment; the chatbot trap is, directionally, a mid-market condition.

Finding 4: Consolidate, productionize, and build in-house

Three strategic moves are nearly tied for the year ahead

We asked what major change enterprises anticipate in their orchestration strategy over the next 12 months. Three moves cluster at the top, almost evenly split.

The top three — building in-house control (25%), standardizing on one framework (24%), and moving agents from sandbox to production (23%) — are statistically indistinguishable and tell a single story: enterprises are moving from experimentation to operational consolidation. They want fewer frameworks, more production exposure, and more ownership of the control layer; only 4% expect no change. The appetite for custom in-house control planes is notable alongside the platform concentration in Finding 1 — enterprises are standardizing on model-provider platforms while simultaneously planning to wrap them in control logic they own, the hybrid posture that Finding 6 makes explicit.

Finding 5: Nearly seven in 10 plan to switch — and the biggest group of movers has no shortlist 

The strategic change enterprises anticipate (previous finding) comes with vendor motion attached. Asked whether they plan to adopt a new, additional, or replacement agent orchestration platform in the next twelve months, more respondents are moving here than in any other layer we track.

Asked which platforms they are considering, the most common answer among those in motion is none yet: 29% of all respondents are evaluating without a shortlist, the largest single response after "not considering a change." Among named candidates, OpenAI leads at 16%, followed by LangChain/LangGraph at 12% and Anthropic at 7% — and notably, the independent frameworks draw roughly double their current usage footprint in forward consideration, the same pattern our security tracker found for specialist vendors. Read with this report's concentration and lock-in findings, the picture completes itself: the major model-platform providers hold roughly four-fifths of today's primary usage, vendor lock-in has become the leading fear, 96% anticipate a strategic change — and now the purchase intent to act on all of it, with the largest bloc of buyers still undecided. The most concentrated layer of the agentic stack is also, as of June, the least settled.

Finding 6: Investment flows to workflow tooling

Tooling and permissions lead the spend; monitoring trails

We asked which orchestration-related investment will grow most next year. Agent workflow tooling leads, with security and permissions enforcement behind.

Workflow tooling leading (34%) is the budget-side expression of the reliability-and-multi-step priority in Finding 3: the money is going to the machinery that strings steps together dependably. Security and permissions enforcement (25%) and scaling infrastructure (20%) follow — the investments required to take agents from sandbox into production, the strategic move in Finding 4. Monitoring and debugging draws a smaller 11%, with another 11% reporting flat budgets. The weight on tooling, permissions, and scaling over pure observability signals that enterprises are spending to build and harden orchestration, not merely to watch it run.

Finding 7: The control plane will be hybrid — and lock-in is why

Enterprises expect to split control between providers and their own layer

We asked where enterprises expect the primary control plane for agents to live by the end of 2026, and what worries them most if that control sits inside a model-provider platform. A clear majority expect a hybrid model — and vendor lock-in is the reason.

Hybrid control is the dominant expectation by a wide margin (51%), and only 6% expect to hand control to a provider-managed service outright. Read together, the hybrid, custom, and externally-abstracted options — every architecture that keeps control at least partly outside the provider — sum to 88% (89 of 101). The reason surfaces directly when we asked about the risk of provider-resident control: vendor lock-in leads at 35% (35 of 101), ahead of security and permissioning limitations (28%) and inflexibility across models and tools (21%). The pattern echoes the prior wave’s “don’t trust the model to police itself” posture — here, enterprises will build on a provider’s platform but decline to be governed entirely by it. The hybrid control plane is the architectural hedge against the lock-in they most fear.

The June figure asserting a preference for a hybrid control plane marks movement from earlier. In the April–May survey (n=145), only 34% expected a hybrid control plane, and a greater number (12%) expected to hand control fully to a provider-managed service. These two snapshots don’t yet measure a confirmed longitudinal trend — but the direction of the conversation is unambiguous: toward keeping control.

Lock-in is also a new arrival as a top concern. In the April–May wave, the leading concern was security and permissioning limitations (32%), with lock-in second at 24%; by June the two had traded places. The worry about provider platforms appears to be maturing from whether they can be secured to whether they can be replaced.

Finding 8: The chatbot trap — most “agents” aren’t agents yet

Enterprises admit most deployments are still chatbot wrappers

We asked enterprises to assess their portfolios honestly: what share of their deployed “agents” are true multi-step orchestrated workflows versus simple single-prompt chatbot wrappers. The answer is the defining finding of this wave.

This is the gap at the center of the report. Combining the bottom two bands, 71% of enterprises (72 of 101) say a quarter or fewer of their deployed “agents” are genuinely orchestrated — and just 10% (10 of 101) have crossed the halfway mark. The ambition documented in the earlier findings — model-provider platforms, reliability-first success metrics, production rollouts, a deliberate control architecture — runs well ahead of the deployed reality, which remains overwhelmingly single-prompt assistants dressed as agents. This is less a contradiction than a roadmap: the platforms, budgets, and strategies are being put in place precisely because the orchestrated portfolio is still so thin. The open question for later waves is how fast the reality closes on the ambition.

Finding 9: Fiscal control is still reactive

Only a minority can stop a runaway agent before the bill arrives

Finally, we asked how enterprises enforce fiscal control over agent token consumption — the risk that an autonomous loop exhausts a budget before anyone intervenes. Most rely on native caps or after-the-fact monitoring; real-time programmatic control is the exception.

More than a quarter of enterprises (27%) admit they have no real-time, programmatic way to stop an agent before a budget-breaking bill arrives — they learn of it from the logs afterward. Another 32% lean entirely on the native caps and throttles built into their primary platform, a control only as good as the provider’s tooling and one that ties back to the lock-in concern of Finding 6. The enterprises building custom gateways (23%) or exploiting cross-model routing to arbitrage cost (19%) are the ones treating token burn as an engineering problem to be controlled deterministically. As with orchestration maturity, fiscal control is an area where the operational reality lags the ambition: agents are moving toward production faster than the cost-control plane around them is being built.

It’s worth noting, a split appears according to company size: roughly one in three enterprises under 2,500 employees (34%) exercises only reactive control of agent spend, against 20% of larger enterprises — directional figures, but consistent with the chatbot-trap split. The mid-market is running the least mature agents on the least instrumented budgets.

The bottom line: The layer is real; most of the agents aren't yet

Organizations with 100 or more employees describe an orchestration strategy that is consolidating quickly and maturing slowly. They are standardizing — for now — on model-provider platforms, which collectively hold roughly four-fifths of primary usage, chosen for the gravity of the underlying model, and they judge success by reliable multi-step execution. Investment is flowing to workflow tooling and permissions, the strategy is to consolidate frameworks and push agents into production, and the control plane they expect is deliberately hybrid, because vendor lock-in is the risk they fear most. But the standardization is provisional: 68% plan to adopt a new, additional, or replacement orchestration platform within twelve months — the highest switching intent of any layer we track — and the largest group of those movers has not yet shortlisted a candidate. Today's concentration describes where enterprises are, and visibly does not describe where they intend to stay.

But the honest self-assessment punctures the ambition. Seventy-one percent say a quarter or fewer of their deployed "agents" are truly orchestrated, only 10% are past the halfway mark, and more than a quarter cannot stop a runaway agent in real time. The orchestration layer — the platforms, the budgets, the control architecture — is being built ahead of the orchestrated portfolio it is meant to run. At 101 respondents in a single June wave this reads as a clear directional signal rather than a precise measurement: enterprises have decided how they want to orchestrate agents well before most of their agents are doing anything an orchestration layer is for. The questions for subsequent waves are whether the deployed reality closes the gap on the ambition — and, with nearly seven in ten buyers in motion and most of them undecided, which platforms the settled stack finally lands on.

Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, results read directionally rather than as a confirmed trend. Respondents include product and program managers, CIOs, CTOs and CISOs, consultants and advisors, and directors and VPs of data, AI, and engineering, across Technology/Software, Financial Services, Healthcare, and other sectors.

Nach den Leaks vor einigen Tagen hat Samsung nun im Rahmen des „Galaxy Unpacked“-Events die neue Spitzenuhr Galaxy Watch Ultra 2 vorgestellt. Die bislang fortschrittlichste und leistungsstärkste Smartwatch des Unternehmens wurde für besonders anspruchsvolle Nutzer und extreme Abenteuer entwickelt.

Samsung

Die Galaxy Watch Ultra 2 ist mit einer Reihe spezieller Tracking-Modi für Outdoor-Sportarten ausgestattet, darunter „Trail Run“ für das Geländelaufen. Dieser Modus erfasst unter anderem Höhenunterschiede und Kletterfortschritte und warnt vor den Auswirkungen des Geländes, um das Verletzungsrisiko zu verringern.

Die Smartwatch ist zudem dank der IP69K-Zertifizierung – der höchstmöglichen IP-Schutzklasse – vollständig tauchfähig. Die Galaxy Watch Ultra 2 kann unter anderem Tauchtiefe, Wassertemperatur und Zeit direkt am Handgelenk erfassen, während Sie sich unter der Wasseroberfläche befinden.

Thomas Deehan / Foundry

Die Uhr überwacht zudem, wie stark Sie beim Laufen schwitzen, und gibt Ihnen Empfehlungen, wann und wie viel Sie trinken sollten, um Ihre Laufziele zu erreichen. Selbstverständlich erfasst die Galaxy Watch Ultra 2 auch andere Gesundheitsdaten.

Die Galaxy Watch Ultra 2 wird von der Snapdragon Elite-Plattform von Qualcomm angetrieben und ist mit 2 GB Arbeitsspeicher sowie 64 GB Speicherplatz ausgestattet. Der Akku der Uhr hat eine Kapazität von 800 mAh und lässt sich in einer halben Stunde auf 40 Prozent schnell aufladen.

Das 1,52 Zoll große Super-AMOLED-Display ist etwas größer als das des Vorgängermodells und verfügt über eine Auflösung von 498 x 498 Pixeln sowie eine maximale Helligkeit von bis zu 5.000 Candela pro Quadratmeter. Das Display mag zwar etwas größer sein, doch die Galaxy Watch Ultra 2 ist dafür 12 Prozent dünner als ihr Vorgängermodell.

Thomas Deehan / Foundry

Preis und Verfügbarkeit

Die Galaxy Watch Ultra 2 ist in den Farben „Titanium Silver“ und „Titanium Grey“ erhältlich und hat einen empfohlenen Verkaufspreis von 749 Euro. Erhältlich ist sie bereits im Samsung-Onlineshop und auch bei Amazon.

Neben der Galaxy Watch Ultra 2 hat Samsung auch die neue Galaxy Watch 9 vorgestellt. Mehr dazu lesen Sie hier: Galaxy Watch 9 im Praxistest: Zwei Dinge, die mir gefallen, und eines, das ich nicht mag.

Read more →

The post From Awareness to Action: Helping Organizations Prepare for Post-Quantum Cryptography appeared first on IT Security News.

Read more →

The post What Is Cryptocurrency and How Does It Actually Work? appeared first on IT Security News.

Hallo, ich bin der Michi, willkommen zur vierten Ausgabe des HMX-6-Newsletters. Diese Woche erfahrt ihr, welche Grafikkarten wir in der HMX 6 verbauen. Außerdem verraten wir, warum Halo das Design der HMX 6 prägen wird. Außerdem reisen wir zurück ins Jahr 2012 zur Höllenmaschine 4, die mit vier Grafikprozessoren neue Maßstäbe beim Gaming setzte. Wenn ihr keine Ausgabe verpassen wollt, könnt ihr den Newsletter kostenlos abonnieren – aber vergesst nicht, die Anmeldung via E-Mail zu bestätigen. Viel Spaß beim Lesen!

Hier geht es direkt zum Gewinnspiel der HMX 6 im Gesamtwert von 40.000 Euro.

HMX 6: 2x RTX 5090 von ZOTAC GAMING und Halo-Design

Jetzt können wir endlich verraten, welche Grafikkarten in der HMX 6 stecken: Als primäre Gaming-Grafikkarte der HMX 6 ist die RTX 5090 AMP Extreme INFINITY gedacht, während wir parallel dazu die RTX 5090 ARCTICSTORM AIO für verlustfreie Skalierung verwenden, um Bildqualität und -wiederholrate in praktisch jedem Videospiel zu verbessern. Natürlich könnt ihr die gebündelte Kraft der zwei 5090 auch im kreativen Einsatz nutzen, etwa beim 3D-Rendering oder KI-Berechnungen. Hier findet ihr alle Informationen zu den zwei ZOTAC-Grafikkarten.

ZOTAC

Eigentlich wollten Kris und ich euch diese Woche schon den aktuellen Stand des Casecon im Halo-Design zeigen. Doch unserem Modder Stefan Ulrich fehlen noch diverse Materialien. Jetzt fahren wir wahrscheinlich nächste Woche, doch die Zeit drängt schon wieder, denn wir wollen ja auf die Gamescom mit der HMX 6.

Rückblick: Die Höllenmaschine 4 setzte technische und optische Maßstäbe

Neue Maßstäbe setzten wir 2012 auch bei der Vermarktung der Höllenmaschine 4 – zumindest für unsere Verhältnisse: vier aufwendig produzierte Teaser-Videos mit Engelchen und Teufelsdamen sowie Fritz als Padawan von Obi-Wan Michi. Das hat riesigen Spaß gemacht und uns als Team Hölle zusammengeschweißt – und war der Beginn einer wunderbaren Freundschaft.

PC-WELT

Technisch auf der Höhe der Zeit waren wir mit den beiden Grafikkarten ASUS GTX690-4GD5, die jeweils zwei 915 MHz schnelle Nvidia Geforce GTX 690 beherbergten. Vier Grafikprozessoren gleichzeitig waren damals absoluter Wahnsinn und sorgten regelmäßig für offene Münder. Dazu gab es den Sechskerner Intel Core i7-3960X, 64 GB RAM im Vierkanalmodus, mit der OCZ RevoDrive die erste PCIe-SSD in einer Höllenmaschine und mit 10 Terabyte natürlich auch wieder verrückt viel HDD-Speicherplatz.

Sein höllisch gutes Aussehen verdankt das Gehäuse den international bekannten Casemoddern Martin und Stefan Blass. Sie haben ins Cooler Master Cosmos II ein Sichtfenster gefräst und per Airbrush lodernde Flammen auf die beiden Flügeltüren gezaubert. ARGB war damals noch kein Thema, aber mit dem Multidimmer von Richter waren immerhin individuelle Farbtöne und -wechsel per IR-Fernbedienung möglich. Hier geht es zum liebevoll restaurierten Artikel zur Höllenmaschine 4 aus 2012.

Maus mit Noctua-Lüfter und Steam Machine im Praxis-Test

Diese Woche ist eine skurrile Mail in meinem Postfach gelandet: Pulsar und Noctua präsentieren stolz die Früchte ihrer Zusammenarbeit: die Feinmann F01 Noctua Edition, eine Gaming-Maus mit aktiver Belüftung der Handflächen. Ich bin gespannt, wer sich über kühlere Handflächen beim Zocken freut.

Noctua/Pulsar

Mein Kollege und Namensvetter Michael Crider hat sich die kostspielige (ab 1.039 Euro) Steam Machine gekauft und einem ausführlichen Praxistest unterzogen. Sein Fazit fällt allerdings ernüchternd aus: Ein günstiger Mini-PC mit selbst installiertem SteamOS bietet derzeit nahezu denselben Nutzen für deutlich weniger Geld.

Warum es ein Problem ist, dass in neuen Laptops alte CPUs zum Einsatz kommen, erklärt mein Kollege Mark Hachman.

Vielen Dank fürs Lesen!

ommende Woche besuchen Kris und ich endlich unseren Modder Stefan, der uns dann hoffentlich schon das fast fertige Tisch-PC-Gehäuse für die Build-Week präsentiert – immer optimistisch bleiben, denn langsam drängt die Zeit. Außerdem reisen wir zurück ins Jahr 2013 zur legendären Höllenmaschine 5 mit den vielen Totenköpfen. Wenn ihr nichts verpassen wollt, abonniert den kostenlosen HMX-6-Newsletter – und denkt daran, eure Anmeldung per E-Mail zu bestätigen. Ich freue mich schon auf nächste Woche – bis dann! Euer Michi.

Watch the latest episode of VCF Breakroom Chats. In Episode 91, Kyle Gleed and Sehjung Hah discuss how real-time metrics in VMware Cloud Foundation (VCF) 9.1 transforms VMware infrastructure into a true private cloud. Building on operational improvements and enhanced visibility into metrics and costs, VCF 9.1 enables teams to do the following.   Learn more … Continued

The post VCF Breakroom Chats | Episode 91 Spotting Infra Issues Instantly with VCF 9.1  appeared first on VMware Cloud Foundation (VCF) Blog.

⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️


@endingwithali →
Twitch: https://twitch.tv/endingwithali
Twitter: https://twitter.com/endingwithali
YouTube: https://youtube.com/@endingwithali
Everywhere else: https://links.ali.dev

Want to work with Ali? hak5@endingwithali.com

[❗] Join the Patreon→ https://patreon.com/threatwire
0:00 0 - Intro
1 - Linux AI Security Response
2 - GitHub Is Overwhelmed
3 - Meta’s Bad AI
4 - BSides News
5 - Outro

LINKS
🔗 Story 1: Linux AI Security Response
https://linuxsecurity.com/news/security-projects/akrites-vulnerability-response
https://www.linuxfoundation.org/press/linux-foundation-and-industry-leaders-launch-akrites-to-defend-critical-open-source-software-against-ai-enabled-cyber-threats
🔗 Story 2: GitHub Is Overwhelmed
https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/
https://cybersecuritynews.com/gitlost-vulnerability-github/
https://thehackernews.com/2026/07/dormant-github-accounts-help-attackers.html
https://securitylabs.datadoghq.com/articles/coordinated-github-api-enumeration/
https://thehackernews.com/2026/07/public-github-issue-could-trick-github.html
🔗 Story 3: Meta’s Bad AI
https://www.wired.com/story/meta-pauses-employee-tracking-program-following-internal-security-breach/
https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/
https://thehackernews.com/2026/07/metas-new-ai-image-tool-lets-others-use.html
https://cybernews.com/news/meta-pulls-controversial-ai-image-tool/
https://about.fb.com/news/2026/07/introducing-muse-image-meta-ai/
🔗 Story 4: BSides News
https://cybernews.com/news/apple-openai-lawsuit/
https://cybernews.com/tech/mamdami-click-to-cancel/
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
____________________________________________

Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.

Ein Netflix-Abo hat mittlerweile so gut wie jeder, doch der eine oder andere wartet vielleicht noch auf eine Möglichkeit, das Streaming-Angebot kostenlos zu testen. Das war seit den Anfängen von Netflix nicht mehr möglich, doch jetzt gibt es wieder einen kostenlosen Probezeitraum.

Bis zu 30 Tage können Sie den Streamingtest jetzt kostenlos nutzen. Teilweise werden auch nur 14 Tage angeboten, der Gratis-Zeitraum scheint also je nach Standort oder genutztem Browser zu variieren. Auf der Webseite von Netflix Deutschland wurden uns auch nur 14 Tage für 0 Euro angezeigt. Es kann aber helfen, wenn Sie auf ein anderes Gerät wechseln oder Cookies löschen.

Wichtig: Das Angebot gilt explizit nur für Neukunden, nicht für wiederkehrende Abonnenten. Allerdings ist es recht einfach, diesen Umstand zu umgehen, wenn Sie sich einfach mit einer anderen E-Mail-Adresse als zuvor registrieren. Dann haben Sie zwar keinen Zugriff auf Ihren alten Account inklusive persönlicher Daten, Listen und Streaming-Historie, doch das ist sicher zu verschmerzen.

Nach Ablauf des Probezeitraums müssen Sie sich für ein Abo entscheiden (oder vorher kündigen). Zur Wahl stehen Standard mit Werbung für 4,99 Euro monatlich, Standard ohne Werbung für 13,99 Euro monatlich oder Premium für 19,99 Euro monatlich.

Warum genau Netflix gerade jetzt ein Probe-Abo wieder einführt, ist nicht ganz klar. Vermutlich versucht der Anbieter aber, neue Abonnenten dazu zu gewinnen, nachdem die Zahlen zuletzt stagnierten. Zwar ist Netflix der größte Anbieter für Streaming, doch die Konkurrenz schläft nicht. Seit Januar 2026 gibt es beispielsweise auch HBO Max in Deutschland, das mit großen Namen wie Game of Thrones, House of the Dragon, Harry Potter oder Superman wirbt.

Eine Übersicht aller wichtigen Streaming-Dienste finden Sie hier, inklusive Preisen, Vorteilen und Nachteilen.

In this video Kaspersky explores what it means to protect vulnerable and digitally vulnerable groups, and why these challenges differ online and offline. Learn about the barriers people face, the importance of digital confidence, and how we support communities that need it most.

Find more details in the report: https://kas.pr/7jar

#kaspersky #esg #sustainability #cybersecurity #inclusion

Wir schreiben das Jahr 2003. Ich bin ein Neuntklässler und spiele auf der Original-Xbox mit einem Controller, der ungefähr so groß ist wie eine Servierplatte. Ich besitze Halo und Dead or Alive 3 und bin von der Grafik völlig begeistert. Das nächste Spiel, das ich mir kaufe, ist Crimson Skies, ein arcadeartiges Luftkampfspiel, das alternative Geschichte mit Abenteuer-Pulp verbindet und über eine wirklich hervorragende Steuerung verfügt.

Seit über 20 Jahren versuche ich nun, dieses Gefühl – wenn schon nicht genau diese Erfahrung – wieder aufleben zu lassen.

Die meisten der Blockbuster-Titel aus dem ursprünglichen Xbox-Sortiment können Sie bereits jetzt auf dem PC spielen, darunter auch Halo, für das sowohl ein Remaster als auch ein Remake in Vorbereitung sind. Einige der eher nischenorientierten Titel waren jedoch schon seit sehr, sehr langer Zeit nicht mehr erhältlich, mit Ausnahme einiger weniger, die Sie über den Game Pass streamen können.

Microsoft hat beschlossen, einige dieser weniger bekannten Klassiker – und vielleicht auch ein paar, die dem Begriff „Klassiker“ nicht ganz gerecht werden – in Form vollständiger Portierungen für PC-Spieler verfügbar zu machen.

Xbox-„Klassiker“ erhalten PC-Ports

Das Unternehmen nennt dies „Xbox-Abwärtskompatibilität auf dem PC“. Der Start erfolgt mit vier Spielen, weitere sollen in Kürze folgen. Diese Spiele laufen lokal auf Ihrem Windows-PC, offenbar ohne jegliche Emulation (oder falls eine Emulation stattfindet, wird dies nicht ausdrücklich erwähnt), wobei bestimmte Mindestsystemanforderungen gelten, darunter eine GTX 950- oder Radeon RX 550-Grafikkarte. Grundsätzlich sollte jeder PC, der in den letzten sechs oder sieben Jahren auf den Markt gekommen ist, diese Anforderungen erfüllen, einschließlich Laptops und Handhelds mit integrierter Grafik.

Zu den ersten Titeln gehört Crimson Skies: High Road to Revenge, von dem ich erst später erfuhr, dass es sich um eine ausschließlich für Konsolen veröffentlichte Fortsetzung eines früheren PC-Spiels handelt. Es kostet zehn Euro – erstaunlich günstig in einer Welt, in der Microsoft 40 Euro für eine Wieder-Wieder-Wiederveröffentlichung von Skyrim verlangt.

Ich habe es sofort gekauft und wollte es herunterladen … doch das geht nicht, da es laut der Xbox-App für Windows nur per Streaming über den Game Pass verfügbar ist.

Microsoft gibt an, dass man die neueste Version des Xbox-Insider-Builds benötigt, über die ich bereits verfüge. Dies scheint eine schrittweise Einführung zu sein – ein häufiges Problem bei Funktionen, die von der Xbox-Windows-App abhängig sind. Ich bin etwas verärgert, dass ich es nicht sofort ausprobieren kann.

Das bedeutet auch, dass es nahezu unmöglich sein wird, das Spiel auf einem SteamOS-basierten Gerät zu spielen. Was für mich persönlich sehr schade ist, da ich gerade erst eine Steam Machine gekauft habe. Ich werde diesen Artikel aktualisieren, sobald ich das Spiel zum Laufen gebracht habe.

Microsoft

Die weiteren Titel sind Blinx: The Time Sweeper, einer der frühen Versuche, der Xbox ein Maskottchen-Plattformspiel zu geben, Conker: Live & Reloaded, ein Remake des N64-Kuriosums Conker’s Bad Fur Day, das nach der Übernahme von Rare durch Microsoft entstand, sowie das extrem für die 2000er Jahre typische Partyspiel Fusion Frenzy. Alle vier waren Teil von Microsofts anfänglicher Veröffentlichungsoffensive für die Xbox, und Blinx sowie Crimson Skies sind zudem über den Game Pass verfügbar.

Ich bin mir sicher, dass es vielen PC-Spielern genauso geht wie mir und sie an mindestens eines dieser Spiele schöne Erinnerungen haben. Insbesondere Blinx bot einige sehr interessante Spielkonzepte, die auf älteren Konsolen nicht möglich waren – ermöglicht durch die interne 8-GB-Festplatte der Xbox, ein entscheidender Unterschied zur Playstation 2 und anderen Konsolen. Weitere Spiele sollen angeblich in Zukunft in die Xbox-Abwärtskompatibilität aufgenommen werden, wobei nicht genau angegeben wurde, um welche es sich dabei handelt.

Tiefgreifende Probleme bei Xbox bleiben bestehen

Doch ich fürchte, ich muss die Stimmung hier zum Schluss etwas trüben. Die Xbox als Plattform und als Geschäftsbereich von Microsoft befindet sich in einer prekären Lage: Sie kann im Wettbewerb mit der Playstation nicht mithalten, wird von Valve mit Steam und SteamOS unter Druck gesetzt und entlässt Tausende von Mitarbeitern aus ihrem riesigen, kostspieligen Bestand an Entwicklern und Publishern. Xbox muss dringend Spieler zurückgewinnen, die nach den massiven Preiserhöhungen für den Game Pass und die Xbox-Hardware möglicherweise zögern, der Plattform noch zu vertrauen.

Diese nostalgischen Neuzugänge für den PC folgen kurz nach Gerüchten über ein neues Fallout-Spiel des bei Fans beliebten Entwicklers (und der Microsoft-Tochter) Obsidian, der stark von Entlassungen betroffen war. Es liegt nahe, beide Schritte als Versuch zu betrachten, das Ruder herumzureißen und/oder die Spieler dazu zu bringen, die tiefgreifenden Probleme innerhalb von Xbox und Microsoft insgesamt zu vergessen. Dazu wird es jedoch mehr als eine 23 Jahre alte Portierung brauchen.

Data security is a core part of how Kaspersky protects its products and users. In this video we talk about our approach to protecting data, the measures behind it and why continuous improvement matters. Watch to learn how we build trust through responsibility and resilience.

Find more details in the report: https://kas.pr/7jar

#kaspersky #esg #sustainability #cybersecurity

The post Nvidia bets physical AI can solve healthcare robotics’ data problem appeared first on AI News.

This video demonstrates how digital forensic investigators can quickly reconstruct a proprietary Synology RAID, browse the file system before imaging, and perform targeted logical imaging instead of acquiring the entire multi-terabyte array.

In this video, TaskForce 2:

- Automatically detects Synology SHR and SHR-2 configurations

- Reconstructs RAID with no manual setup

- Lets you browse evidence before imaging

- Creates logical image of selected files and folders

- Recovers data from missing or damaged drives using RAID parity

If you're working with a NAS holding many terabytes of data and you just need a few key files, this workflow gets you there faster – without cutting corners on integrity.

⏱️ Timestamps

00:00 Intro
00:15 The problem with Synology RAID reassembly
01:10 How standard RAID works
01:20 What is Synology SHR
03:31 TaskForce 2: built for Synology RAID
03:35 Step 1: Connect sources
03:58 Step 2: RAID autodetection
03:50 Step 3: Review before imaging
04:23 Step 4: Logical imaging
05:01 Step 5: Missing/damaged RAID recovery

📝Resources:

🔗 Learn more about Atola TaskForce 2 RAID capabilities: https://atola.com/products/taskforce/forensic-raid-image.html

🔗 Follow Atola on LinkedIn: https://www.linkedin.com/company/atola-technology/

In this video, we explain what sustainability means for Kaspersky. Learn how respect for human rights, adherence to regulatory requirements and meaningful contribution to society and environment shape our guiding principles. From our commitment to transparency, resilient supply chains to measures that ensure our products can be trusted, we're actively working towards a safer future.

Find more details in the report: https://kas.pr/7jar

#kaspersky #esg #sustainability #cybersecurity

The post Why I Founded SMECYBERInsights—and Why UK SMEs Need It More Than Ever appeared first on SME Cybersecurity News.

The post Steffi Lewis’s Your Ping: Why This Human-Centred Connection Initiative Matters More Than Ever appeared first on SME Cybersecurity News.

The post Privacy: AI meeting notetakers save time, but SMEs must weigh privacy, trust and data control risks now appeared first on SME Cybersecurity News.

Viele PC-Systeme kämpfen mit unnötig hohen CPU-Temperaturen, obwohl eigentlich ausreichend Gehäuselüfter eingebaut sind. Häufig liegt die Ursache nicht an zu schwacher Kühlung, sondern an einer ungünstigen Luftführung (Airflow). Besonders verbreitet ist der Ansatz, alle oberen Lüfter konsequent als Abluft zu konfigurieren.

Was logisch klingt, kann in klassischen PC-Gehäusen mit Luftkühler allerdings genau das Gegenteil bewirken. Mit einer kleinen Anpassung der Lüfterausrichtung lässt sich der Prozessor oftmals messbar kühler betreiben, und das ganz ohne zusätzliche Kosten. Der Kern des Problems liegt dabei im Zusammenspiel von Front- und Top-Lüftern.

In den meisten Midi-Tower-Gehäusen strömt kühle Luft von vorne ins Gehäuse und soll idealerweise direkt zum CPU-Kühler gelangen. Ist der vordere obere Lüfter aber als Abluft konfiguriert, saugt er einen Teil dieser Frischluft sogleich wieder nach oben ab, bevor sie den CPU-Kühler erreicht. Der Luftstrom wird dadurch kurzgeschlossen.

Anstatt gezielt durch Kühlkörper und Lamellen zu fließen, verlässt die kalte Luft das Gehäuse nahezu ungenutzt. Die Folge sind höhere CPU-Temperaturen, obwohl mehrere Lüfter aktiv arbeiten. Abhilfe schafft hier eine einfache Änderung, bei der der vordere obere Lüfter nicht als Abluft, sondern als Zuluft arbeitet.

Noctua

Dadurch wird die vorne angesaugte Frischluft gezielt in Richtung CPU gedrückt, anstatt sie vorzeitig aus dem Gehäuse zu ziehen. Der hintere obere Lüfter bleibt weiterhin als Abluft konfiguriert, sodass die erwärmte Luft kontrolliert abgeführt wird. Diese Mischung aus Zu- und Abluft im Deckel widerspricht zwar älteren Faustregeln, sorgt in der Praxis aber für einen gleichmäßigeren und effizienteren Luftstrom rund um den Prozessor.

Ob diese Anpassung bei Ihrem System sinnvoll ist, lässt sich relativ einfach überprüfen. Öffnen Sie zunächst das Gehäuse und verschaffen Sie sich einen Überblick über die aktuelle Lüfterausrichtung. Die meisten Lüfter zeigen mit kleinen Pfeilen auf dem Rahmen an, in welche Richtung Luft strömt. Alternativ hilft ein Stück Papier oder Rauch eines Räucherstäbchens, um die Strömungsrichtung sichtbar zu machen.

Drehen Sie anschließend den vorderen oberen Lüfter so, dass er Luft ins Gehäuse hineinbläst, während der hintere obere Lüfter weiterhin Luft nach außen fördert. Für einen aussagekräftigen Vergleich sollten Sie die Temperaturen vor und nach der Änderung unter möglichst gleichen Bedingungen messen.

Starten Sie zunächst Windows, lassen Sie das System einige Minuten laufen, um es im Leerlauf zu stabilisieren, und notieren Sie die CPU-Temperatur. Danach eignen sich ein längerer Gaming-Test oder eine realistische Dauerlast, etwa durch ein anspruchsvolles Programm, besser als ein synthetischer Stresstest. Beobachten Sie dabei die durchschnittliche CPU-Temperatur über mehrere Minuten.

Gamemax

In vielen Fällen lässt sich eine Absenkung um ein bis zwei Grad Celsius feststellen, gelegentlich auch mehr, abhängig von Gehäuse, Lüfterleistung sowie CPU-Kühler. Wichtig ist, dass diese Methode besonders für Systeme mit klassischem Luftkühler gilt. Wird der Prozessor über eine Wasserkühlung mit Radiator versorgt, spielt die Luftführung im Bereich des CPU-Kühlers eine andere Rolle.

Wenn der Radiator im Deckel sitzt, entscheidet die Lüfterausrichtung primär darüber, ob der Fokus auf niedrigeren Prozessortemperaturen oder auf einer besseren Gesamtabfuhr der Gehäusewärme liegt. Hier gibt es keine universelle Lösung, weshalb eigene Tests besonders sinnvoll sind. Ebenfalls Vorsicht ist geboten, wenn Ihr Gehäuse über zusätzliche Lüfter im Boden verfügt.

In derartigen Konfigurationen kann ein oberer Zuluftlüfter unerwünschte Verwirbelungen erzeugen, die warme Luft im Gehäuse halten oder die Grafikkarte stärker aufheizen. In diesen Fällen funktioniert das klassische Konzept mit Abluft im Deckel meist zuverlässiger. Die wichtigste Erkenntnis lautet daher, dass starre Regeln beim Airflow oftmals zu kurz greifen.

Anstatt alle oberen Lüfter reflexartig als Abluft zu konfigurieren, lohnt es sich, die tatsächliche Luftbewegung im eigenen Gehäuse zu betrachten und gezielt anzupassen.  

Lesetipp: Argus Monitor im Test – Hardware-Temperatur immer im Blick

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Official

• Announcing Rust 1.97.1

Newsletters

• The Embedded Rustacean Issue #76

Project/Tooling Updates

• Announcing Topcoat: a framework for building full-stack reactive web apps with Rust
• Syn 3.0.0
• What’s New in RustRover 2026.2
• kobe 0.35.0: readiness gates and cert recycling
• Comhad v0.1.0: a ranger-style tui cyberduck replacement for browsing S3
• Nova v0.2.1: computer-use MCP server
• winit now has comprehensive cross-platform drag-and-drop support, exposing most of the power of the underlying OS APIs
• crimson-crab v0.1.0 - a production-grade Rust SDK for the Claude API (streaming, tool use, prompt caching, batches)
• ferrovec: dependency-light HNSW vector search in Rust, compiled to WebAssembly for private in-browser semantic search
• OrdoFP 0.1.0 released — a functional-programming toolbelt for Rust (HList, GAT type classes, optics, effects, monad transformers)
• Freya 0.4
• buildline: merging cargo and ninja's build profiling into one timeline
• cochlea 0.3.0: melody read-back, MFCC timbre, a master limiter, and MIDI import for the deterministic agent-audio engine
• flodl 0.6.0: multi-host heterogeneous DDP - mismatched GPUs across hosts beat the fastest card alone
• hwatu: a daemon-based WebKitGTK browser for tiling WMs with ~13ms window spawn
• kache 0.11.0: broader compiler coverage and libc-aware keys
• tracing-reload - reload layer without panics
• Introducing OpenTypeless: Voice Input That Actually Works
• Reading a Rust crate's capabilities out of its compiled symbols

Observations/Thoughts

• Battery packs: Let's talk about crates, baby
• Capture Clauses as Effects
• Hardening Rust Code For Production
• Tokio Gives Progress, Not Ordering: Scheduling 1M Tasks
• Rust service hardening and production checklist
• [audio] The Rust Foundation with Rebecca Rumbul, Lori Lorusso, and David Wood, Rust Foundation leadership and board
• [video] Jon Gjengset: Open Source Maintenance 2026-07-18
• [video] Rust Release Changelog - 1.97.0
• [video] Livestream: Rust in Ubuntu

Rust Walkthroughs

• I hash-chained my agent's audit log. Then I found 13 breaks in it — all mine, all benign.
• Two tricky bugs in a Rust daemon
• [video] Backend Concepts in Rust: Securely Managing App Secrets
• [video] Build with Naz - Ep 21: High Performance Flat 2D Arrays in Rust (SIMD, L1 cache)

Crate of the Week

This week's crate is xan, a TUI toolkit to work with CSV files.

Thanks to Simeon H.K. Fitch for the suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

If you are a feature implementer and would like your RFC to appear in this list, add a call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

Let us know if you would like your feature to be tracked as a part of this list.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

• No Calls for participation were submitted this week.

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

• No Calls for papers or presentations were submitted this week.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

Updates from the Rust Project

576 pull requests were merged in the last week

Compiler

• account for async closures when pointing at lifetime in return type
• comptime inherent impls
• dep_graph: deduplicate task reads with an epoch-filtered index recorder
• eagerly check for ambiguity in macro parsing
• implement #[diagnostic::opaque] attribute to hide backtraces of macros
• shrink ast::Expr64

Library

• add explicit Iterator::count impl for str::EncodeUtf16
• implement bool::toggle
• implement const_binary_search
• implement Debug helpers via Cell
• implement VecDeque::truncate_to_range
• make pin!() more foolproof
• move std::io::BufRead to alloc::io
• move std::io::Read to alloc::io
• move std::io::read_to_string to alloc::io

Cargo

• use PGO for Cargo
• timings: only report units the job queue actually ran
• do not include proc-macro deps in rustc search path args
• include SBOM outputs in fingerprints
• lazily initialize git2 fetch transports

Rustdoc

• fix auto trait normalization env
• use PGO for rustdoc

Clippy

• add block_scrutinee lint
• avoid invalid ref_as_ptr suggestions in const/static initializers
• detect == 0 on unsigned types as a manual_clamp lower bound
• fix if_not_else linting on macro expanded conditions
• fix needless_collect suggests a suggestion that cannot be typed
• non_zero_suggestions: don't lint signed integer div/rem as NonZero
• manual_filter: don't eat comments in the and_then suggestion
• require the use of as _ for indirectly used traits in clippy sources
• rewrite min_ident_chars
• use #[must_use] determination from the compiler

Rust-Analyzer

• avoid index panic when flycheck list is empty
• add capture hints to coroutines
• add handler for E0572
• do not assume array destructuring assignments with rest pattern are constant-sized
• eagerly normalize .await's IntoFuture::Output
• enable auto trait inference
• extract variable preserving whitespace from macro input
• fix coroutines not recording binding owners correctly
• fix crashes in assists due to .unwrap() calls in SyntaxFactory
• fix hir crate leaking bound variables from skipped binders
• fix InferenceContext:identity_args using the wrong DefId
• fix syntax bridge panic when spilting float
• handle enum variants in next-solver generics
• implement lowering of HRTB
• invalid pattern_matching_variant lowering due to recovery
• merge WherePredicate::ForLifetimes into WherePredicate::TypeBound
• only write anon const ty in parent's inference result if it doesn't have its own inference
• panic with a function item and a proc macro item having a duplicate name
• parser to error on macro type bound
• spawn proc-macro servers on requests clearing the client cache
• use quote! inside ast::make::expr_call()
• use Result for the lsp-server Response payload type
• record expressions in types in ExprScope

Rust Compiler Performance Triage

The two most notable changes this week were #159115, which resulted in pretty nice instruction count wins for full incremental builds on several benchmarks, and #159091, which enabled PGO for rustdoc, which makes it ~3-4% faster across the board.

There were two large rollups with tiny performance regressions, which made it difficult to find the offending PRs.

Triage done by @Kobzol. Revision range: 5503df87..d527bc9b

Summary:

2 Regressions, 3 Improvements, 6 Mixed; 4 of them in rollups 34 artifact comparisons made in total

Full report here.

Approved RFCs

Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

• No RFCs were approved this week.

Final Comment Period

Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

Tracking Issues & PRs

• Tracking Issue for bool::toggle
• Tracking Issue for vec_try_remove
• Avoid computing layout of enums with non-int discriminants
• Tracking Issue for const_btree_len
• Add raw_borrows_via_references lint
• stabilize size_of_val_raw, align_of_val_raw, Layout::for_value_raw
• rustc_passes: lint unused #[path] attributes on inline modules

• Emit note when calling rustc without specifying an edition
• Let the OS handle stack growth
• Add target_feature_available_at_call_site

• Deallocate post-2026 funds from PM and compiler-ops

• Do the bytes of a pointer have to stay in the same order?

No Items entered Final Comment Period this week for Cargo, Language Reference, Language Team or Rust RFCs.

Let us know if you would like your PRs, Tracking Issues or RFCs to be tracked as a part of this list.

New and Updated RFCs

• RFC: Refactor the libs team

Upcoming Events

Rusty Events between 2026-07-22 - 2026-08-19 🦀

Virtual

• 2026-07-24 | Virtual (Girona, ES) | Rust Girona
  • Sessió setmanal de codificació / Weekly coding session
• 2026-07-28 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
  • Fourth Tuesday
• 2026-07-28 | Virtual (Washington, DC, US) | Rust DC
  • Mid-month Rustful
• 2026-07-30 | Virtual (Berlin, DE) | Rust Berlin
  • Rust Hack and Learn
• 2026-07-31 | Virtual (Girona, ES) | Rust Girona
  • Sessió setmanal de codificació / Weekly coding session
• 2026-08-01 | Virtual (Kampala, UG) | Rust Circle Meetup
  • Rust Circle Meetup
• 2026-08-02 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
  • Rust Deep Learning: First Sunday
• 2026-08-04 | Virtual (London, UK) | Women in Rust
  • 👋 Community Catch Up
• 2026-08-05 | Virtual (Indianapolis, IN, US) | Indy Rust
  • Indy.rs - with Social Distancing
• 2026-08-07 | Virtual (Girona, ES) | Rust Girona
  • Sessió setmanal de codificació / Weekly coding session
• 2026-08-11 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
  • Second Tuesday
• 2026-08-13 | Virtual (Berlin, DE) | Rust Berlin
  • Rust Hack and Learn
• 2026-08-13 | Virtual (Nürnberg, DE) | Rust Nuremberg
  • Rust Nürnberg online
• 2026-08-14 | Virtual (Girona, ES) | Rust Girona
  • Sessió setmanal de codificació / Weekly coding session
• 2026-08-18 | Virtual (Washington, DC, US) | Rust DC
  • Mid-month Rustful
• 2026-08-19 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
  • Dealing with Dependencies

Africa

• 2026-08-11 | Johannesburg, ZA | Johannesburg Rust Meetup
  • Rust's extended standard library

Asia

• 2026-07-25 | Mumbai, IN | Rust Mumbai
  • ​Rust Mumbai — July Meetup 🦀
• 2026-07-26 | Pune, IN | Rust Pune
  • Rust Pune: July 2026

Europe

• 2026-07-23 | Berlin, DE | Rust Berlin
  • Rust Berlin Talks: The next generation
• 2026-07-23 | London, UK | Rust London User Group
  • LDN Talks: July 2026 Antithesis Takeover
• 2026-07-23 | London, UK | London Rust Project Group
  • Rama modular service framework for Rust
• 2026-07-23 | Paris, FR | Rust Paris
  • Rust meetup #87
• 2026-07-25 | Stockholm, SE | Stockholm Rust
  • Ferris' Fika Forum #28
• 2026-07-27 | Augsburg, DE | Rust Meetup Augsburg
  • Rust Meetup #20: Julian Dickert - Supply chain security in Rust: Evaluating crates for production
• 2026-07-29 | Poland, PL | Rust Poland
  • Rust Poland x Kraków #10
• 2026-07-30 | Copenhagen, DK | Copenhagen Rust Community
  • Rust meetup #70
• 2026-07-30 | Manchester, UK | Rust Manchester
  • Rust Manchester July Code Night
• 2026-08-18 | Aarhus, DK | Rust Aarhus
  • Hack Night: Trust but verify the LLM
• 2026-08-18 | Leipzig, DE | Rust - Modern Systems Programming in Leipzig
  • Topic TBD

North America

• 2026-07-22 | Austin, TX, US | Rust ATX
  • Rust Lunch - Fareground
• 2026-07-22 | Los Angeles, CA, US | Rust Los Angeles
  • Rust LA: Rust in Distributed Systems with Flight Science!
• 2026-07-22 | New York, NY, US | Rust NYC
  • Rust NYC: Write A Custom Coding Agent and wasm_zero
• 2026-07-23 | Mountain View, CA, US | Hacker Dojo
  • RUST MEETUP at HACKER DOJO
• 2026-07-25 | Boston, MA, US | Boston Rust Meetup
  • Porter Square Rust Lunch, July 25
• 2026-07-25 | Brooklyn, NY, US | Flower
  • BOG-A-THON 2
• 2026-07-30 | Atlanta, GA, US | Rust Atlanta
  • Rust-Atl
• 2026-08-01 | Boston, MA, US | Boston Rust Meetup
  • Chinatown Rust Lunch, Aug 1
• 2026-08-04 | Boston, MA, US | Boston Rust Meetup
  • Evening Boston Rust Meetup at Red Hat, Aug 4
• 2026-08-06 | Saint Louis, MO, US | STL Rust
  • Shipping Temporal: How a Global Rust Ecosystem Built Chrome’s Newest Web API
• 2026-08-13 | Lehi, UT, US | Utah Rust
  • Utah Rust August Meetup
• 2026-08-13 | San Diego, CA, US | San Diego Rust
  • San Diego Rust August Meetup - Back in person!
• 2026-08-15 | San Francisco, CA, US | Flower
  • BOG-A-THON 3
• 2026-08-18 | San Francisco, CA, US | San Francisco Rust Study Group
  • Rust Hacking in Person
• 2026-08-19 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
  • Dealing with Dependencies

Oceania

• 2026-07-23 | Perth, AU | Rust Perth Meetup Group
  • Rust Perth: July Meetup!
• 2026-07-30 | Melbourne, AU | Rust Melbourne
  • Rust Melbourne July 2026

South America

• 2026-08-08 | São Paulo, SP | Rust-SP
  • Rust SP - Aug/2026

If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

Jobs

Please see the latest Who's Hiring thread on r/rust

Quote of the Week

We were planning on publishing a blog post announcing this at the same time as making the repo public, but ran out of private repo CI usage 😭.

– Carl Lerche on r/rust about the launch of topcoat

Despite a lamentable lack of suggestions, llogiq is glad to have found this quote.

Please submit quotes and vote for next week!

This Week in Rust is edited by:

• nellshamrell
• llogiq
• ericseppanen
• extrawurst
• U007D
• mariannegoldin
• bdillo
• opeolluwa
• bnchi
• KannanPalani57
• tzilist

Email list hosting is sponsored by The Rust Foundation

Discuss on r/rust

We recommend to read this FAQ before using a pre-release in a production environment.

Please use the attached archives for installing or updating Matomo.
The source code download is only meant for developers and will require extra work to install it.

• Latest stable production release can be found at https://matomo.org/download/ (learn more) (recommended)
• Beta and Release Candidate releases can be found at https://builds.matomo.org/ (learn more)

Hello, again. This is Trey.

Welcome to part 8 in my Cheap Yellow Display (CYD) Project series.

If you wish to catch up on earlier episodes, you can find them on my HPR profile page https://www.hackerpublicradio.org/correspondents/0394.html

It is hard to believe that I started this project and the HPR series to document it more than a year ago. Time flies. Life happens. I spent the last 8 months so focused on work related activities that I had to set the project aside. And once I set it aside, it was difficult to get back to again. The one time I tried, I found that my son's old Windows laptop, which I had commandeered to use for the project, was once and truly dead.

We live in a different world now than we did when I began this project. Today, everything is about AI – how it is changing our world, increasing efficiencies, and even displacing certain types of jobs. "Vibe coding" is transforming the way we make software, and now everyone is a developer.

Within my organization, we are all being strongly encouraged to learn more about AI and apply it in our daily work. We are blessed to have access to a wide range of training and to powerful tools which support the process. Several colleagues within my organization and outside my organization have recommended Claude Code -- for development, for organization, for brainstorming, and for much more. My role is not that of a developer, and I have had no need for Claude Code at work. There are plenty of other tools for me to use.

But at home, I thought... I could install Claude Code at home to experiment with and to learn. And then it hit me. I wonder if I could use Claude Code to help me with my stalled CYD project.

"Hello, my name is Trey, and I am a fraud."

OK. I don't think I am a fraud, but having never used such a powerful tool to help me code, I feel a little bit like a fraud, with Claude doing the work for me. Let's talk through what we did.

As I mentioned, I was unable to use the laptop on which I created the original GUI code. But no worries, because It was all on GitHub, right?

So, I began by trying to install Claude Code on one of my Ubuntu machines. That failed miserably, and all the instructions I found online recommended running it on Windows. So I transitioned to installing Claude Code on a freshly built Windows 10 system using some old hardware which will not support Windows 11. Surprisingly, It seems that Claude wants to run within Ubuntu on Windows Subsystem for Linux (WSL).

Once I went through all the hoops for installing and setting up my basic subscription, I got to work. I created a new directory to use for all my project files, and another one for Claude to write all its output files to.

Everything I have read and heard about using Claude Code for a project like this recommended beginning by using Claude to create the project plan. So my first prompt was as follows:

"I am building a project using an ESP32 cheap yellow display. The final goal is to have a device with a graphical user interface which will allow me store several text messages, each assigned to their own specific button. Then, when one of the buttons is pressed, the message will be converted into morse code, and the message will be sent by blinking an onboard LED. I already have the initial design for the GUI coded in my github repository. Please construct a detailed step by step plan for building this application"

I wanted to keep it simple at the beginning, so even though I plan to use an opto-isolated relay for the output, I am starting out using the built in LED.

Claude asked me for the URL for my Github repository, and I provided it. After thinking for a bit, it produced a project plan.

CYD Morse Sender — Step-by-Step Build Plan

What You Already Have

- 3 fully designed LVGL screens (Send, Config, Keyboard)

- 7 send buttons with green styling on the Send Screen

- Speed slider (5–30 WPM) and program slot dropdown on Config Screen

- Text area + LVGL keyboard widget on Keyboard Screen

- Display driver and touchscreen hardware initialized (but touch read was stubbed out)

---

Phase 1: Fix Touchscreen Input

Initialize the XPT2046 on VSPI, replace the hardcoded touched = false with real touch data, calibrate raw ADC coordinates to screen pixels, and verify all three nav buttons transition screens correctly.

Phase 2: Persistent Message Storage

Use Preferences.h / NVS to store 7 messages ("msg0" – "msg6") that survive power cycles. Load on boot and populate send button labels.

Phase 3: Config Screen — Slot Selection & Speed

Wire the Program dropdown to g_selectedSlot, wire the Speed slider to g_wpm with a live WPM label, and wire the Set button to clear the text area and navigate to the Keyboard Screen.

Phase 4: Keyboard Screen — Capture and Save Text

On keyboard OK (LV_EVENT_READY): read the text area, save to NVS, update the send button label, navigate back. On Cancel: navigate back without saving.

Phase 5: Morse Code Engine

Build morse.h with the full A–Z / 0–9 lookup table, a textToMorse() converter, and Paris-standard timing (unit_ms = 1200 / wpm).

Phase 6: Non-Blocking LED Transmission

State machine (IDLE / LED_ON / LED_OFF) driven by millis() in a morseUpdate() function called every loop — no delay(). LED on GPIO 17 (blue).

Phase 7: Wire the Send Buttons

Each button calls startMorse(getMessage(slot)) if not already transmitting. Disable all send buttons during TX; re-enable when the state machine reaches the end.

Phase 8: Integration & Polish

Stop button, WPM persistence, empty-slot guard, serial debug output, final touch calibration, end-to-end test checklist.

---

Recommended order: Phase 1 → 2 → 7 (partial) → 5 → 6 → 7 (full) → 3 → 4 → 8

This was wild! Claude determined exactly how far along I was in the project, and also alerted me to the fact that the "touch read was stubbed out". Ugh. This means that the files I had uploaded to GitHub were my original GUI files (Episode 05 – HPR4532 - https://hackerpublicradio.org/eps/hpr4532/index.html ) and not the ones that I finally got working properly (Episode 07 – HPR4624 - https://hackerpublicradio.org/eps/hpr4624/index.html ). That was my own fault. Did I mention that I don't get Git? I REALLY need to learn to properly use Git!

But, we have a plan, broken down by eight numbered phases. And they seem to address all the functionality I wanted with a few additional things I had not thought about. Interestingly, even though these phases are sequentially numbered, Claud recommended that we approach them in a bizarre order: Phase 1 → 2 → 7 (partial) → 5 → 6 → 7 (full) → 3 → 4 → 8 .

Alright. Let's see what we can do. The first phase is to fix the touchscreen input.

Claude took me through it step-by-step, asking as it needed to read specific project files.

Finally, it wrote a new ui.ino code file to my speficied output directory for me to test. I copied it into the correct file location, said a quick prayer, compiled in Arduino IDE, and downloaded to the CYD.

Well, that is... interesting. The display looked nothing like it was supposed to. There were vertical green bars with smaller dashed green vertical stripes in them. I will include a picture in the show notes so that you can see what it looked like and why it was so difficult to describe.

I spent the next hour or so trying to explain what I was seeing to a chat bot. Claude recommended potential fixes which either did nothing or made the situation worse. I began questioning whether this was a good idea, how people actually gained efficiencies talking to a bot, and even several life choices.

Then I had a thought. I prompted Claude:

If I were to take a picture of the screen on the cheap yellow display and copy it into the output folder, would you be able to analyze it to better determine what is wrong and how to fix it?

Shockingly, Claude answered in the affirmative, and told me to copy the picture to the output folder and let it know when to proceed. It analyzed the picture and more of the supporting files it had copied from my GitHub, asking each time if it could access that file. It determined that my original code was written for a flavor of LVGL version 8 and I was now using LVGL 9.5.

It recommended changes, and then asked permission to make those changes, file by file. .h files & .c files, Finally, I just gave it permission to edit the files in the project folder without asking for permission for each file each time. Claude was still explaining each change, showing me exactly what would be changed, and asking for permission, so that I could review all of the changes. But now it was not asking additional permission to write to each of the impacted files.

Next, Code compiled and downloaded. Different screen, but not right. Again, I took a picture and gave it to Claude to analyze. So, Claude paused and altered the code to generate a specific test pattern overtop of the GUI.

The test pattern was supposed to cover the entire rectangular screen. But parts of the pattern were in a square on the screen and parts were not. Another photograph and analysis, told Claude that there were some rotation/screensize issues.

We repeated this several times. Some resulted in improvement, and others did not.

This is the point where I noticed something interesting. Not about Claude, specifically, or about the app. But I noticed something interesting about myself and about the process.

Previously, when I was working through some of these challenges without Claud, I found myself becoming more and more stressed, frustrated, and angry, until I found a solution. Then another problem would repeat the cycle. Success in the end was great, but the emotional extremes during the process were not always pleasant.

Now, I was effectively managing the project, and relaying information to the resource responsible for fixing the problems -- a very different experience.

But I also ran into another issue. Claude became absolutely certain that the problem revolved around the device not accurately knowing where the 4 corners of the screen were. But in reality, the output of the test pattern was rotated 90 degrees from the actual screen. It took several iterations of me insisting that the problem had to do with screen orientation and not corner coordinates. It was interesting to experience the tool doubling down on an obvious mistake, but we finally resolved that.

Again, while it was frustrating, it was much less stressful.

We proceeded to Phase 2: Persistent Message Storage where we ensured that the button labels on the send screen were stored in the devices persistent storage, so that, when they are edited to contain the message they should send, that information would survive a reboot.

Next, we combined elements of Phase 5: Morse Code Engine , Phase 6: Non-Blocking LED Transmission , and Phase 7: Wire the Send Buttons together. Building the morse code engine was an area I had been thinking about for a while. I already had working parts of something similar in the Arduino practice oscillator I have referenced a few times in this series. The code for the practice oscillator may be found on my GitHub, but it was all based on original code from jmharvey1, with my only contribution being making pin assignments variables so that the code could easily be ported to different devices.

So, I was happy that we were building the morse code engine directly. The code for it may be found in morse.h, which uses a constant character lookup table to define each character. Without any specific direction from me, Claude used the PARIS timing methods I have already described within Episode 6 of this series. It defines timing for DOT, DASH, LETTER_GAP, and WORD_GAP, and all are based on a simple calculation of 1200 ms / the number of words per minute (WPM) we wish to transmit.

Along the way, we discovered that, if we tried to use the delay() function, it would crash the program due to a conflict with the LVGL timer used for touchscreen inputs. Claude altered all the delays accordingly.

Then, Phase 3: Config Screen — Slot Selection & Speed allowed us to configure the WPM we wished to use in addition to selecting a specific Send button to reconfigure. This forced us to work on Phase 4: Keyboard Screen — Capture and Save Text which is used to type the entries for each Send button. At this point, I also decided that we would want to also use the Keyboard Screen to send ad hoc morse as we typed it.

During this phase we discovered several bugs which seemed to cause random freezes. Careful troubleshooting with messages output to the Arduino IDE's serial console helped us narrow down the causes and remedy them.

Finally all the tests worked and I am able to merrily pre-configure macro buttons with custom messages and use the CYD to send the morse code for those messages to the on-board LED at whichever rate I specify.

I have noticed in my presentation of this narrative that I repeatedly slip into the first person plural terms "we" and "us" instead of the first person singular terms "I" and "me". I have unconsciously personified Claud and recognized it as an integral part of my (formerly one person) development team.

I finally configured Claude to connect to my GitHub repo and upload all the files and documentation. We additionally created a CYD-Narrative.md file which describes in more detail all the work which was done on the project. I still do not 100% get git, but we are successfully using it.

You can find all these files in my GitHub repo ( https://github.com/jttrey3/CYD_MorseSender ) where they are shared under a GPL 3.0 license.

There are still several additional steps I plan to complete in the next few months.

1. I will be integrating an opto-isolated relay which will allow me to plug the device into the straight key input on any amateur radio. This will require a battery power source, charge controller, and more hardware.

1. I... make that "We" (Claude & I) will be modifying the code to support an audio side tone through an attached speaker when sending code
2. We will add an output selection switch to the config page to choose any combination of speaker, relay, or LED as output.
3. We will develop a downloadable firmware which I hope to share with the Cheap Yellow Display community.

If you can think of any additional features you would like to see integrated, please drop me an email using the address in my HPR profile.

I may also work with a friend to attempt to 3d print a case for the entire contraption, and I will be sure to record additional episodes sharing the process.

I have learned so much throughout this project, about the CYD, ESP32, GUIs, Claude Code, GitHub, and most of all, about myself.

Does using AI to develop this code make me a fraud? It still feels like it in some ways.

Does it make me more productive? ABSOLUTELY! I made consistent forward progress when I only had 30-60 minutes each day to work on it, and everything discussed in this episode was completed in less than a week. If I had been able to work on it for a few hours uninterrupted, it may have only taken me 3-5 hours.

Does it empower and inspire me to do more projects like this? 100% I feel like I had support working with me the whole way. I was less stressed overall, and it had less of an impact on the amount of and quality of time I spent with my family.

I will be wrapping up this series soon, without any more 6 month gaps, I hope.

Until next time...

Provide feedback on this episode.

Instead of forcing agents to interpret your UI, use WebMCP to expose what it can actually do!

Resources:
Learn more about WebMCP → https://goo.gle/4wdG9Af

Subscribe to Google for Developers → https://goo.gle/developers

Speaker: Sayali Godbole

• Changed /code-review to run as a background subagent, so review work no longer fills your conversation and keeps stacked slash commands as its review target
• Added screen-reader announcements of deleted text for word and line deletions (Option+Delete, Ctrl+W, Cmd+Backspace, Ctrl+U, Ctrl+K) in --ax-screen-reader mode
• Fixed Windows paths with \u-prefixed segments (like C:\Users\unicorn) being corrupted into CJK characters in tool inputs, which made those files inaccessible
• Fixed the left arrow key discarding the conversation with no undo: presses right after editing now ask to confirm, and Esc in the agent view returns to the conversation it backgrounded
• Added HTTP status and error text to claude mcp list and /mcp when a server fails to connect, and a warning for MCP config values with hidden leading or trailing whitespace
• Fixed multi-line paste collapsing into one line with j in place of newlines in terminals that encode pasted newlines as Ctrl+J
• Fixed /context reporting stale pre-compact token usage after compacting from the message picker
• Fixed /ultrareview failing on descriptive arguments like "review my auth changes" — they now run a review of your current branch with the text applied as a note to the findings
• Fixed /code-review ultra silently running a local review in non-interactive sessions — it now launches the cloud review
• Fixed gateway spend metering to price Bedrock application-inference-profile ARNs and other config-mapped upstream model IDs at the configured model's rates
• Fixed mojibake when a long IDE selection was truncated mid-emoji, and a case where a tool executor error could be silently dropped
• Fixed an engine teardown race that could start and abandon a phantom turn, and made input pushed after close consistently rejected
• Fixed spurious "[Request interrupted by user]" messages after interrupted tool calls, and an unpaired tool_use block left in the transcript when a tool aborted mid-response
• Fixed VoiceOver reading "new line" instead of echoing the typed space at the end of the input in --ax-screen-reader mode
• Fixed plugin and settings panels not moving the terminal cursor to the focused row, so screen readers and magnifiers can follow arrow-key navigation
• Fixed crashes (maximum call stack exceeded) when a deeply nested watched directory tree was deleted or moved, and when rendering deeply nested UI trees
• Fixed pull request events occasionally being lost when a session exited immediately after creating or linking a PR
• Fixed the Bedrock setup wizard failing profile verification for assume-role profiles in partitioned AWS regions and on proxy-only networks
• Fixed rare negative or incorrect turn duration measurements after a system clock adjustment by timing turns with a monotonic clock
• Fixed the "N MCP servers need authentication" startup notice over-counting claude.ai connectors that aren't connected in claude.ai
• Fixed prompt history entries being dropped or duplicated when history writes raced or failed
• Fixed a retry loop that re-sent identical doomed requests after a context-overflow error with a large thinking budget; Ctrl+B backgrounding now applies the same background-shell caps as other paths
• Fixed agent frontmatter hooks running from untrusted folders: hooks now require the agent file's own folder to have accepted workspace trust
• Fixed fork-session lineage being lost after compaction in headless and SDK sessions
• Fixed a resumed session failing every turn, or crashing on resume, when its history held a malformed delta attachment
• Improved /ultrareview error feedback so Claude can correct an invalid argument instead of retrying it unchanged
• Improved auto mode: the dangerous-rm, background-&, and suspicious-Windows-path checks no longer open permission dialogs; the auto-mode classifier adjudicates them instead
• Improved sandbox command restrictions for IDE interactions
• Improved trust dialogs to name the repository root the grant covers
• Changed /deep-research to start only when invoked manually; Claude no longer launches it on its own
• Changed plan mode with auto to no longer prompt for Bash commands the static analyzer can't prove read-only; the auto-mode classifier judges them instead
• Added an announcement when fast mode changes as a result of switching models via /config model=<x> or Remote Control
• Changed server-managed settings so benign feature and cost toggles no longer trigger the settings-approval prompt
• Changed agent markdown files to reject agent names containing :, which is reserved for plugin namespacing
• Changed skills with context: fork to run in the background by default; opt out per skill with background: false
• Added yes/no/on/off/1/0 (case-insensitive) as accepted values for skill and plugin frontmatter booleans, alongside true/false
• Fixed remote sessions continuing to send heartbeats after their worker was replaced, which left long-lived desktop and IDE processes retrying a rejected request every few seconds forever

Rapid advances in AI are forcing organizations to rethink how people learn new skills. The question isn't only how employees adapt, but whether K–12 education, universities, and professional development can keep pace.

Waiting until workforce shortages appear could mean reacting too late. Updating curricula before major disruptions occur may help prepare students and workers for jobs that increasingly involve AI and automation.

If you could change one thing about today's education system to prepare people for an AI-driven workforce, what would it be?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#Education #FutureOfWork #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec

The company launched Inflection AI Labs, a public-facing research and experimentation arm, alongside Pi Journeys, the lab's first product experiment — an AI experience designed to adapt to a user's life stage, whether that's becoming a parent, taking on caregiving duties, changing careers, or aging. The announcement arrived with a research report on consumer AI habits and a substantial update to Pi, the company's flagship chatbot, adding improved voice, memory, and new agentic tools for reminders, to-do lists, and shopping.

"Inflection AI is the company. Pi is our flagship consumer product. Inflection AI Labs is where we experiment, explore personal intelligence and share more publicly. Pi Journeys is the first public experiment from Inflection AI Labs," CEO Sean White told VentureBeat in an exclusive interview.

Behind the tidy org chart is a far more interesting story: a company attempting one of the more unusual second acts in the AI industry, powered by an argument that the entire market is optimizing for the wrong thing.

Why Inflection AI believes the chatbot era's biggest flaw is that it's transactional

White's central claim is that today's AI assistants — including the industry's most capable models — are fundamentally transactional. You ask, they answer, the session ends. He believes that architecture misses most of what people actually need from artificial intelligence in their daily lives.

"One of the things that really struck us in particular, and this showed up in the research, was that a lot of the work is very transactional, and you'll hear me say a lot that we've been shifting all this from transactional to relational systems," White said. "Not everything is going to be: I do a single turn, I utter a question, I get a search response back."

White frames the industry's evolution as a progression through four kinds of intelligence. First came raw IQ — the foundation model race. Then emotional intelligence, which Inflection made its signature with Pi's famously warm conversational style. Then agentic intelligence — AI that acts rather than just talks — which White says Inflection absorbed from its enterprise work. The fourth, and the one Inflection is now staking its future on, is what the company calls relational intelligence: AI that understands not just you, but the web of people around you.

"There's so much fear about these things pushing people into loneliness,” White said. “If we design these pro-social systems as another design criteria, that actually makes a huge difference."

That design philosophy is a pointed counter-narrative to one of the loudest anxieties in consumer AI right now: that emotionally engaging chatbots deepen isolation by substituting for human contact. Inflection argues the opposite is possible — that an AI with structured knowledge of your relationships can push you back toward people rather than away from them.

Inside Pi Journeys, the AI companion that maps your relationships and life stages

Pi Journeys makes that idea concrete. When users first open the product, it asks about their life stage — caregiver, household manager, midlife transition — and then builds what White describes as specially structured memory around the people who matter in that context. From there, the system becomes proactive.

"It starts to build up memories around that, and it acts as a memory prosthetic — but in a pro-social way," White said. "It doesn't get in the way of your interactions with other people; it really helps facilitate them." The system might remind a user, for example, that a friend deserves a call, or resurface what was last discussed with a family member involved in a parent's care.

White, who spent years as chief R&D officer at Mozilla before taking Inflection's helm, was quick to flag the obvious privacy implications of an AI that maps your social graph. "We've built a lot of privacy systems into this," he said, noting users can delete and manage the people recorded in their profile. Whether consumers will trust a venture-backed AI company with a structured database of their most important relationships remains one of the biggest open questions hanging over the product — and one that enterprise buyers evaluating Inflection's technology will watch closely.

Asked why this was the first Labs experiment, White was direct: "Pi Journeys takes into account people's life stages and experiences because we have heard from users that we can provide more value in helping them navigate their lives. Pi Journeys lets us experiment with the early stages of prosocial and relational intelligence because life isn't single-player."

The product has been tested internally and with small closed groups, White said, and is now being released more broadly as an experiment rather than a finished product — a posture the Labs branding is designed to make explicit.

What Inflection's consumer AI research reveals about how people actually use chatbots

Inflection Labs' first publication, the State of Consumer AI Research Report, offers the empirical scaffolding for the strategy. The average consumer now uses roughly two different AI tools every day and three per week, the company found — evidence, in Inflection's reading, that no single assistant has locked up consumer loyalty and that the market remains contestable.

More telling is why people choose the tools they do. Respondents cited personalization, style and tone, context awareness, and — notably — emotional understanding as deciding factors. They also said they want AI to be more than a productivity engine: a coach or mentor to motivate them, a chef to suggest recipes, a DJ to curate playlists.

"One thing we're certainly finding is that a lot of that also is in work, not so much in everyday life," White said. "That's our focus right now — the everyday life part."

This is a shrewd reading of the competitive map. The best-funded AI labs are pouring resources into coding tools, enterprise agents, and developer platforms, leaving everyday consumer use cases comparatively underserved. White sees the gap clearly. "We see a lot of products that are being aimed more and more at the enterprise," he said. "As a computer scientist by training, I kind of love the IDEs as this tool, but it's not really great for everybody. There's so much regular everyday use from folks that is either purely voice or that is purely mobile."

He recalled a conversation with a conference staffer who told him she owned only a phone, no laptop — exactly the kind of user, he argued, that the industry's developer-centric product roadmaps have left behind.

How the $650 million Microsoft deal hollowed out Inflection — and set up its second act

To understand why any of this is remarkable, you have to rewind to March 2024. Inflection was then one of the hottest startups in AI, having raised $1.3 billion in mid-2023 in a round backed by Microsoft, Nvidia, Bill Gates, and Reid Hoffman — more than $1.5 billion in total. Pi had crossed one million daily active users, per Reuters.

Then, in a deal that reshaped how the industry thinks about acqui-hires, Microsoft hired away co-founder and CEO Mustafa Suleyman, chief scientist Karén Simonyan, and most of the company's roughly 70 employees, paying Inflection about $650 million largely to license its technology, as Reuters reported. Suleyman now runs Microsoft's consumer AI business. The structure of the deal drew scrutiny from the FTC and Britain's competition regulator, though the UK's Competition and Markets Authority cleared it in September 2024 and EU regulators declined to act.

White, installed as CEO in the aftermath, steered the remnant company hard toward enterprise, acquiring three startups in late 2024 — Jelled.AI, BoostKPI, and the European consulting firm Boundaryless — and telling TechCrunch that November that Inflection had no intention of competing with companies building 100,000-GPU frontier systems.

Tuesday's announcement doesn't reverse that position so much as complicate it. Asked how to think about the company today, White called it "a consumer-first strategy that bridges both consumer and enterprise efforts" — and he insists the two sides feed each other.

Enterprise deployments, including a partnership with Intel that is among the few he can name publicly, taught Inflection how to run models inside complex infrastructure. Consumer products, meanwhile, let the company iterate at speed. "The part I also like about the consumer side, and this has always been true, is that we can move faster, experiment faster, and try and learn faster," White said.

The six-month prediction: relationship-aware AI is coming to the enterprise

Buried in White's consumer pitch is the claim that should matter most to technical decision-makers. "Normally I'd say like a year, but let's call it six months," he said. "You're going to start to see a bunch of enterprises care a lot more about the relationships that are inside the enterprises and what that picture is, not just the workflows."

If White is right, the wave of workflow-automation agents currently flooding the enterprise market is only the first phase of business AI adoption — with relationship-aware systems, tested first on consumers, following close behind. Inflection is essentially using its consumer products as a live laboratory for capabilities it plans to sell into companies. It's a capital-efficient strategy for a firm that can no longer outspend rivals on training runs, and a risky one, since it depends on consumers showing up in numbers large enough to generate the learning.

The technical substance underneath is equally pragmatic. Pi today runs not on a single proprietary frontier model but on an orchestration layer routing across many models — some descended from Inflection's original fully trained cores, some fine-tuned, some open source, including work with Nvidia that White says gives Inflection access to unreleased cutting-edge models. He also took a swipe at the industry's loose vocabulary around ownership: "When people say that the model is their own, most of the time nowadays — I guess I won't name names — a lot of companies will actually take a checkpoint, and then they will fine-tune from that checkpoint. But very few people actually start from that beginning core."

That candor extends to open source, where White carefully hedged. "We're not ready to promise what I think of as true open source, and by that I mean everything," he said, invoking his Mozilla years overseeing genuinely open projects like Rust and WebAssembly.

Weights without training data and pipelines, he argued, often leave developers unable to do anything meaningful with a supposedly "open" model. "We are a PBC, and there's still a C in there," he added — a reminder that public benefit corporations still have businesses to protect. The Labs will collaborate with academic researchers, including Stanford professors who visited the company's Palo Alto office this week, and continue contributing to open projects such as PyTorch.

Can a diminished Inflection compete with AI giants spending billions?

Reid Hoffman, the LinkedIn co-founder who co-founded Inflection and stayed on through the Microsoft upheaval, framed the announcement in the sweeping terms of his recent writing on AI and human agency. "Humans should be amplified by AI, not replaced. That's the principle Pi was built on," Hoffman said in the announcement. "When that kind of agency is available to everyone, you get superagency."

The skeptic's case is easy to make. Inflection is a fraction of its former size, competing for consumer attention against products from companies spending tens of billions of dollars a year. Pi's model was state of the art in 2023; it is not in 2026. And "relational intelligence" is, for now, a brand claim awaiting proof.

But the bull case is not crazy either. Inflection's own research shows consumers already juggle multiple AI tools and choose them for qualities — tone, emotional understanding, personalization — that frontier labs treat as afterthoughts. The company kept its technology, its Microsoft licensing windfall, and a defensible enterprise niche in on-premise, emotionally intelligent deployments. And it is targeting the one consumer segment — everyday, mobile-first, voice-first life management — that the coding-obsessed giants have largely ignored.

Asked what success looks like twelve months from now, White declined to talk numbers. "It's less about scale for scale's sake and more about scaling for impact by empowering people and improving their lives," he said. "Over the next year, success means leading the market towards relational intelligence and transforming AI interactions from transactional to relational."

Two years ago, Microsoft walked away with Inflection's founders, its staff, and its shot at the frontier — but it left behind the one idea the giants still haven't figured out how to build: an AI that knows the people in your life matter more than the tasks on your list. Inflection is betting the company, again, that the idea was the valuable part all along.

This article How to set up Administrative Governance for Copilot Cowork first appeared on TheWindowsClub.com.

Isabella and Ryan Barnett share their perspectives on Black Hat and why the conference continues to be such an important experience for the cybersecurity community. From groundbreaking research and emerging threats to networking opportunities and industry insights, Black Hat brings together security professionals from around the world to learn, collaborate, and help shape the future of cybersecurity.

In the lab we’re going to build today, we’ll talk about JWTs and how they can affect the security of your website. This is a lab that’s been requested, and I could not be happier that the community is actually suggesting things for me to build. It’s a privilege to do this.

JWT As Security Measure

JSON Web Tokens are used a lot by developers. They provide a way to send ‘data’ with them (e.g., a role from a user), to check for authorization. A JWT consists of 3 parts, separated by a ..

Let’s take this JWT as an example.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30

The first part eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 is called 'the header'. It holds information on the type of the JWT. The second part eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0 is the payload, which holds the claims. This is where that 'data' lives. If you decode this with Base64url you'll learn that this token belongs to John Doe and that he is an administrator. The last part is the important part. This is the signature. Each JWT should be signed with a strong password. Ideally that password is saved in a .env file on the server and not in the code.

So now you might wonder, well if it’s signed, nothing can go wrong right? Well, if that were true, I wouldn’t spend my evenings writing these kinds of blog posts now would I 😅.

Let’s Build The Lab Already

You’re right to think this by now. Enough theory, let’s do some hands on keyboard. As always in this series, I’ll provide you with the lab structure and some code to get us started.

Lab Tree

/mediumLabs
└── /JWT
    ├── server.js
    ├── login.html
    ├── index.html
    ├── admin.html
    ├── /node_modules
    ├── /package-lock.json
    └── /package.json

Code

server.js

const express = require('express');
const jwt = require('jsonwebtoken');
const path = require('path');
const Database = require('better-sqlite3');
const app = express();
const JWT_SECRET = 'secret';
const db = new Database(':memory:');
db.exec(`
  CREATE TABLE users (
    id INTEGER PRIMARY KEY,
    username TEXT,
    password TEXT,
    role TEXT
  )
`);
db.prepare("INSERT INTO users (username, password, role) VALUES ('user', 'password', 'user')").run();
app.use(express.urlencoded({ extended: false }));

app.get('/', (req, res) => res.sendFile(path.join(__dirname, 'login.html')));
function getToken(req) {
  const match = (req.headers.cookie || '').match(/token=([^;]+)/);
  return match ? match[1] : null;
}
app.post('/login', (req, res) => {
  const { username, password } = req.body;
  const user = db.prepare('SELECT * FROM users WHERE username = ? AND password = ?').get(username, password);
  if (!user) return res.redirect('/?error=Invalid+credentials');
  const token = jwt.sign({ username: user.username, role: user.role }, JWT_SECRET);
  res.setHeader('Set-Cookie', `token=${token}; Path=/`);
  res.redirect('/index.html');
});
app.get('/index.html', (req, res) => {
  try {
    res.sendFile(path.join(__dirname, 'index.html'));
  } catch {
    res.redirect('/');
  }
});
app.get('/admin', (req, res) => {
});

app.listen(3000, () => console.log('Listening on http://localhost:3000'));

login.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Login</title>
</head>
<body>
    <h1>Login</h1>
    <form method="POST" action="/login">
        <div>
            <label>Username: <input type="text" name="username" required></label>
        </div>
        <div>
            <label>Password: <input type="password" name="password" required></label>
        </div>
        <button type="submit">Login</button>
    </form>
</body>
</html>

index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Home</title>
</head>
<body>
    <h1>Welcome!</h1>
    <p>You are logged in as <strong id="username"></strong>.</p>
    <p><a href="/admin">Go to Admin Panel</a></p>
    <br>
<script>
        function getCookie(name) {
            return document.cookie.split('; ').find(r => r.startsWith(name + '='))?.split('=')[1];
        }
        function decodeJWT(token) {
            return JSON.parse(atob(token.split('.')[1]));
        }
        const token = getCookie('token');
        const payload = decodeJWT(token);
        document.getElementById('username').textContent = payload.username + ' (role: ' + payload.role + ')';
    </script>
</body>
</html>

admin.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Admin Panel</title>
</head>
<body id="page">
<h1>Admin Panel</h1>
    <p>Welcome, admin. Here is the secret flag:</p>
    <p><strong>FLAG{JWT}</strong></p>
    <br>
    <a href="/index.html">Back to Home</a>
</body>
    <script>
        function getCookie(name) {
            return document.cookie.split('; ').find(r => r.startsWith(name + '='))?.split('=')[1];
        }
        function decodeJWT(token) {
            return JSON.parse(atob(token.split('.')[1]));
        }
        const token = getCookie('token');
        const payload = decodeJWT(token);
        if (payload.role !== 'admin') {
            alert('Access denied. You need to be an admin to view this page.');
        }
    </script>
</html>