Feed aggregator

Hackers accessed the institution’s internal network and deleted two drives containing employee, student, and university data.

The post Mount Royal University Confirms Data Stolen in Ransomware Attack appeared first on SecurityWeek.

Article URL: https://www.insidehighered.com/news/faculty/learning-assessment/2026/07/08/brown-professor-suspects-most-his-class-used-ai-cheat

Comments URL: https://news.ycombinator.com/item?id=48843458

Points: 2

# Comments: 1

Article URL: https://www.bbc.com/news/articles/cg5pd9z2487o

Comments URL: https://news.ycombinator.com/item?id=48843438

Points: 1

# Comments: 0

Article URL: https://singulr.ai/blog/the-hidden-ai-risk-in-your-marketing-stack-shadow-ai-automation-pipelines-and-the-hidden-data-leaks

Comments URL: https://news.ycombinator.com/item?id=48843431

Points: 1

# Comments: 0

Article URL: https://blog.kevingoldsmith.com/2026/03/18/process-is-a-tool-not-a-virtue/

Comments URL: https://news.ycombinator.com/item?id=48843427

Points: 1

# Comments: 1

I find that the latest SOTA modals blatantly ignore some of my instructions or requests, sometimes even after mentioning or requesting it multiple times? I suspect its a consequence of the creators of these's drive for autonomous and completely agentic workflow without human in the loop? I prefer to pair-program and not leave everything to the agent, and this is why I noticed it (or at least feels like its happening).

Comments URL: https://news.ycombinator.com/item?id=48843420

Points: 1

# Comments: 0

An MSG database tracked and categorized hundreds of celebs, famous Knicks superfans, and even some of Taylor Swift’s wedding guests. Labels included “LGBTQIA,” “DO NOT HOST,” and low to high “risk.”

Article URL: https://www.nature.com/articles/d41586-026-02098-z

Comments URL: https://news.ycombinator.com/item?id=48843415

Points: 2

# Comments: 0

Article URL: https://github.com/Vadale/R-ebirth

Comments URL: https://news.ycombinator.com/item?id=48843409

Points: 1

# Comments: 0

Article URL: https://www.neowin.net/news/tuta-is-making-it-easier-to-migrate-all-your-emails-to-tuta-mail/

Comments URL: https://news.ycombinator.com/item?id=48843387

Points: 1

# Comments: 0

Article URL: https://blog.uehiro.ox.ac.uk/2026/06/the-uk-plans-to-ban-romantic-ai-chatbots-for-under-18s-young-people-have-bigger-worries-about-ai/

Comments URL: https://news.ycombinator.com/item?id=48843378

Points: 2

# Comments: 0

Article URL: https://artificialanalysis.ai/models/grok-4-5

Comments URL: https://news.ycombinator.com/item?id=48843376

Points: 1

# Comments: 0

Article URL: https://www.theguardian.com/us-news/2026/jul/07/san-francisco-home-sale-prices-ai

Comments URL: https://news.ycombinator.com/item?id=48843363

Points: 2

# Comments: 0

Article URL: https://casually.onl/article?slug=fediverse-grew-up-2026

Comments URL: https://news.ycombinator.com/item?id=48843356

Points: 2

# Comments: 0

Article URL: https://simonwillison.net/2026/Mar/6/ally-piechowski/

Comments URL: https://news.ycombinator.com/item?id=48843353

Points: 1

# Comments: 1

Article URL: https://andrewkelley.me/post/my-thoughts-bun-rust-rewrite.html

Comments URL: https://news.ycombinator.com/item?id=48843352

Points: 9

# Comments: 0

I found the UX of most speech-to-text apps unnecessarily complicated, so I built Humm as a simple, privacy-first alternative.

Press a custom hotkey, talk, and the text lands in whatever app you're in.

- It runs locally on NVIDIA's Parakeet models - no account and no telemetry

- Works on Windows and Mac

- You can bring your own key if you'd prefer to use cloud models

- Includes a stats page so you can measure timed saved vs typing

- Options to set zero local txt or audio retention

Under the hood:

- Tauri 2

- A modified parakeet.cpp doing realtime transcription, so you see your words as you speak (this feature is windows only for now)

- Qwen3 4B for optional on-device cleanup (rather slow but working on making this better)

https://humm.so

Comments URL: https://news.ycombinator.com/item?id=48843345

Points: 1

# Comments: 0

Every consumer app has a settings menu that lets you make decisions about things like notifications or dark mode. Meta has just decided that anyone can generate AI images of you from your public Instagram account by typing your Instagram handle into a prompt.

On July 7, Meta launched its AI image generation model, Muse Image. It integrates with public Instagram accounts. Now, all someone has to do is tag your account in a prompt, and they can use Meta AI to generate an image using your likeness. According to Meta’s own policy, you won’t be notified if someone does this, making it difficult to know when or how your likeness has been used.

Meta says Muse Image is meant to make AI image generation more personal by letting people reference public Instagram accounts in their prompts. That may sound fun when you’re creating images of yourself. It’s less appealing when anyone else can do the same with your account.

Meta lets you opt out, although finding the setting is its own adventure. On Instagram, go to Settings and activity > Sharing and reuse, then turn off the setting that allows others to create AI images featuring you. Depending on your app version, the wording may vary, and the feature is still rolling out, starting in the US, so you may not see the setting yet.

You’d hope that Meta would tell you up front with a big, bold “Turn this off if you don’t want it” message when you open Instagram, but no such luck. You’d also hope that the company would retroactively remove any images that someone made of you before you opted out, but that’s not happening either.

Opting out only prevents future image generation. Any AI images that someone created before you switched the setting off still remain in circulation.

The only mechanism that comes close to comprehensive protection is switching your account to private.

What’s the risk?

There are privacy and security implications here. Anyone can now generate AI images based on your public Instagram profile without your knowledge, and Meta won’t notify you when it happens. Public Instagram photos were already being harvested by attackers to create deepfakes for identity verification fraud. Giving people an official way to generate AI images based on public profiles lowers the barrier to creating synthetic images that could be used for impersonation, scams, or other abuse.

Cybercriminals are already combining generative AI with automated tools to scale phishing and fraud. Muse Image makes it even easier to generate convincing images based on public identities.

Meta’s AI has introduced other security issues, too. Earlier this year, researchers disclosed a “confused deputy” flaw in Meta’s AI support chatbot that let it make account changes—including changing email addresses and resetting passwords—without adequately verifying who it was talking to. Enabling multi-factor authentication (MFA) appeared to mitigate that issue.

Meta also uses an opt-out approach when training its AI on European user data. The company relies on GDPR’s “legitimate interests” legal basis to process European users’ data for AI purposes, a position that privacy group NOYB has challenged.

Protect yourself

• If your Instagram is public, open Settings and activity > Sharing and reuse and turn off the AI-generation toggle now. Remember, it only stops future image generation.
• Turn on MFA for all your Meta accounts. It’s one of the simplest ways to protect your account if your password is compromised.
• If you want the strongest protection Meta currently offers, switch your Instagram account to private. It’s a blunt solution, but it prevents strangers from using your public profile as source material.

Meta’s own Oversight Board has already said the company needs stronger detection tools and better labeling of AI-generated content. When Meta’s own governance body says the defenses aren’t enough, consumers should take notice.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Google owes its existence to the open web, but today, its technological “innovations” have much to do with locking users into a “walled garden.” The latest of these is “reCAPTCHA Mobile Verification,” an experimental initiative that will let companies block users if they are running independent, "de-googled" versions of Android. These “indie Android” versions are favored by people who want to protect their privacy and their attention by blocking trackers and ads. Worse, this is just the latest in a line of similarly user-hostile measures. 

Long before “agentic AI,” we had the idea that software would act as your agent on the internet. That's why the old-fashioned technical term for a browser is a “user agent.” Your browser acts on your behalf to retrieve information and then show it to you, in the format you choose. It's your agent. 

This is a powerful and profound idea. It is because browsers are our “agents” that we expect them to accept our directives, say, by blocking pop-ups, or by turning off autoplay sound, or by blocking commercial surveillance trackers. 

Your browser does all that because your browser works for you. The reason your browser can work for you is that the web is an open, standardized technology. In theory, anyone who follows the standards published by the World Wide Web Consortium (W3C) can make a browser, and that web browser can connect to any web server. Browsers and servers are interoperable. It's the same force that means you can put anyone's gas in your gas-tank, or anyone's shoelaces in your shoes, or anyone's milk on your cereal. 

But what if manufacturers could dictate those choices to you? What if your light socket refused to use a lightbulb unless it was officially blessed by the socket's manufacturer? What if your dishwasher refused to wash your dishes unless you bought them from one of the manufacturer's “dish partners?” What if your toaster refused to toast “unauthorized bread?” 

It's hard to see how a company could win its market with this strategy. After all, if the dishes are really better than the competition's, you'd buy them voluntarily, without any need for law or technology to force the matter. The only reason to make a dishwasher that refuses a rival's dishes is if the manufacturer's own dishes are ugly, expensive, and/or badly made. 

But once a company owns the market—once they've achieved dominance by buying out their rivals; by bribing potential competitors to stay out of their lane; and by engaging in deceptive conduct to trap key suppliers and customers—they can cement their dominance by blocking interoperability, keeping out rival dishes, milk, gas, lightbulbs, shoelaces and bread, capturing their whole market and squeezing it. 

Once a company owns the market, they can cement their dominance by blocking interoperability.

That's what Google has done, and that's what Google wants to do more of Google's commercial behavior has been so unethical, deceptive and abusive that the company just lost three federal antitrust cases. This thrice-convicted monopolist paid Apple—more than $20b/year— to stay out of the search market: It cheated app vendors, ripping them off with sky-high junk fees and onerous conditions that raised prices while lowering the share of your spending that went to the companies whose products you were paying for. It cheated advertisers, rigging the ad market to gouge businesses on ad prices and underinvesting to fight rampant ad-fraud, sucking hundreds of billions out of the productive economy for overpriced ads that no one saw. 

Google wasn't always this way. The “don't be evil” company owes its very existence to the open web ecosystem. When the company started to index the web in 1998, it was playing on an open field, where any web server could talk to any “user agent,” even one whose user was a startup like Google, that was making a copy of every page on the server. 

For years, Google thrived on the open web, and built open technologies. Android—the mobile operating system that Google bought in 2005 —was presented as an “open” alternative to existing mobile offerings, and as the mobile market collapsed into two companies—Google and Apple—Google always presented Android as the open alternative to Apple's “walled garden.” But there were always ways in which Google's “open” Android wasn't exactly open. The company engaged in illegal “tying” arrangements that forced hardware vendors and carriers to lock out versions of Android that were created by Google's competitors. 

In other words, even though Google offered a mobile platform that was (mostly) technically open, it found other ways to try to choke off the market oxygen for alternative Android versions that tried to capitalize on that technical openness. 

But life finds a way. The existence of an open, modifiable, tinkerer-friendly mobile operating system meant Android hackers could create alternatives to Google's (de facto) walled garden, which thrived in the cracks in that garden wall. Operating systems like CalyxOS, PureOS and Graphene offered a more private, more secure Android experience, one that was largely “de-Googled,” blocking Google's relentless acquisition of your private data. 

And Google's data-hunger is relentless. Android exfiltrates a chunk of your personal and behavioral data every five minutes. The “resting heartbeat” of Android surveillance pulses and pulses, irrespective of whether you're using your device, and the instant you unlock your screen, that heartbeat quickens, sending even more data to the company. All that data has proven irresistible to authoritarian governments. Donald Trump's enforcers have seized on Google data as a vital source of information about the identity of protesters and the location of migrants hunted by ICE. 

So there are plenty of reasons why users would seek out these de-Googled alternatives to Android, finding them in spite of Google's efforts to block access to competing technologies. The worse it got, the better those alternatives looked. 

Perhaps this explains Google's years-long effort to increase the technical barriers to using modified versions of Android, beefing these up to match the commercial restrictions that stand in the way of a de-Googled existence. 

Back in 2023, Google floated the idea of “Web Environment Integrity” (WEI), a set of modifications to web standards that would force your computer to disclose its operating environment to the web servers it connected to, even if you objected to this disclosure. 

WEI was a form of “remote attestation.” That's when your device uses a sub-processor (sometimes called a “Technical Protection Module” or “TPM”) or a walled off part of its main processor (sometimes called a “secure enclave”) to produce a cryptographically signed description of your device and its configuration: which hardware, software, plug-ins, and settings you're running. 

Take away our ability to block obnoxious digital content and you guarantee that we will be flooded with it.

When you connect to a server, it demands that your device send this “attestation” before it handles your request. If your device won't provide this data, or if the server doesn't like (or recognize) your device and its details, it can refuse to deal with you. And because the attestation is prepared by a TPM or a secure enclave that you can't modify or override, you don't get to decide which facts about your device it's allowed to see. 

Practically speaking, this means that remote attestation lets a server refuse to deal with you until you turn off your ad-blocker and your tracker-blocker. It means that the server can discriminate against users who block auto-play sound and video, who block pop-ups, who put the tab in the background when it's playing a mandatory pre-roll ad. 

WEI was especially disturbing in light of Google's plan to kill ad-blockers and privacy blockers through updates to Chrome, an effort that continues to this day. 

These blockers are an important part of the dynamic between web publishers and their users. In the real world, when you get an offer, you can make a counter-offer. That's all an ad-blocker is: a way for users to respond to a server whose opening bid is, “How about you give me all your data and let me take over your computer in exchange for showing you this page?” with “How about 'Nah?'”

We didn't get rid of pop-up ads by making them illegal, or by boycotting advertisers who used them. We got rid of pop-up ads when web users installed pop-up blockers, which made pop-up ads pointless. Take away our ability to block obnoxious digital content and you guarantee that we will be flooded with it. 

These kinds of modifications aren't just used to block ads—they're also key to accessibility. People who have photosensitive epilepsy or suffer from low-contrast vision problems use add-ons to reformat pages so they can safely and legibly access them. 

WEI's creators said they were only trying to put the web on a level playing field with apps, which routinely disclose facts about your device to the companies whose servers you connect to, without asking you, and even if you don’t want them to. Apps are a source of bottomless enshittification, not least because (unlike the web), they enjoy special, dangerous legal protections that make it very legally risky to modify them. WEI wasn't an effort to level the playing field between apps and the web—it was a race to the bottom, an attempt to make the web as enshittification-friendly as apps. 

Public outrage to WEI killed the project, but Google's commitment to augmenting its illegal commercial lockdown efforts with technical lockdowns never ended. Now, Google has rolled out an experimental “reCAPTCHA Mobile Verification” that uses an app, your camera, and your device's TPM or secure enclave to produce an attestation about your Android device. 

This will make it much easier for the apps and other services you interact with to block your device if you run an Android alternative, or if you install a mod that overrides the actions of Google's stock Android. 

This is a terrible idea—it's every bit as bad as WEI was. In an age in which Big Tech is ever-more tied to authoritarian governments, redesigning our devices to tell strangers things we don't want them to know isn't just shortsighted, it's inexcusable. 

 

 

The Post Office has once more extended the standstill period before putting pen to paper on EPOS system