Apple

Apple Delays Home App Update Requirement Until February 2026 (macrumors.com) 10

Apple will officially discontinue support for its original Home architecture (formerly HomeKit) on February 10, 2026. As MacRumors points out, Apple has informed users that they need to "update now to avoid interruptions." AppleInsider reports: The underlying HomeKit architecture was revamped in March 2023 alongside iOS 16.4, so Apple has been supporting both the new and old architecture for the last two years. There were initial problems with stability that may have discouraged some users from upgrading, but those problems have now been addressed.

When Apple stops supporting the original HomeKit architecture, it will break support for the Home app on devices running older versions of iOS, iPadOS, and macOS. iOS 16.2, iPadOS 16.2, macOS 13.1, tvOS 16.2, and watchOS 9.2 are the minimum versions of Apple's platforms that work with the updated Apple Home app, and older devices will lose access.

The update includes support for features like guest access, support for robot vacuum cleaners, and Activity History. Apple says it also provides faster, more reliable performance, especially for smart homes with a lot of HomeKit and Matter accessories installed.

Windows

Windows 10 Update Incorrectly Tells Some Users They've Reached End-of-Life, Despite Having Extended Support (tomshardware.com) 21

An anonymous reader shares a report: Microsoft officially ended mainstream support for Windows 10 last month, nudging users to upgrade to Windows 11. While that led to almost an overnight technological revolution in Japan, elsewhere, it has caused a lot of confusion. Certain versions of Windows 10, like Enterprise LTSC -- and those enrolled in the ESU program -- are still scheduled to receive security updates through at least 2027, but they're starting to see out-of-support messages in Settings.

Various users over the past few days reported that they're being subjected to end-of-life warnings in Windows, despite already qualifying for extended security updates through the ESU program. Windows 10 Enterprise LTSC 2021 and âIoT Enterprise are business-oriented editions of the OS, so they're already supported up to 2032, but even they saw these incorrect messages. This widespread bug started to occur after the KB5066791 updates were pushed on October 14, 2025.

Microsoft has already acknowledged this mishap and said, "The message, 'Your version of Windows has reached the end of support, might incorrectly display in the Windows Update Settings page," confirming it as a mistake. The company has already released a cloud config fix that should remove the message, but you need to be connected to the internet for that, and a restart is also required.

Programming

Cloudflare Raves About Performance Gains After Rust Rewrite (cloudflare.com) 53

"We've spent the last year rebuilding major components of our system," Cloudflare announced this week, "and we've just slashed the latency of traffic passing through our network for millions of our customers," (There's a 10ms cut in the median time to respond, plus a 25% performance boost as measured by CDN performance tests.) They replaced a 15-year-old system named FL (where they run security and performance features), and "At the same time, we've made our system more secure, and we've reduced the time it takes for us to build and release new products."

And yes, Rust was involved: We write a lot of Rust, and we've gotten pretty good at it... We built FL2 in Rust, on Oxy [Cloudflare's Rust-based next generation proxy framework], and built a strict module framework to structure all the logic in FL2... Built in Rust, [Oxy] eliminates entire classes of bugs that plagued our Nginx/LuaJIT-based FL1, like memory safety issues and data races, while delivering C-level performance. At Cloudflare's scale, those guarantees aren't nice-to-haves, they're essential. Every microsecond saved per request translates into tangible improvements in user experience, and every crash or edge case avoided keeps the Internet running smoothly. Rust's strict compile-time guarantees also pair perfectly with FL2's modular architecture, where we enforce clear contracts between product modules and their inputs and outputs...

It's a big enough distraction from shipping products to customers to rebuild product logic in Rust. Asking all our teams to maintain two versions of their product logic, and reimplement every change a second time until we finished our migration was too much. So, we implemented a layer in our old NGINX and OpenResty based FL which allowed the new modules to be run. Instead of maintaining a parallel implementation, teams could implement their logic in Rust, and replace their old Lua logic with that, without waiting for the full replacement of the old system.

Over 100 engineers worked on FL2 — and there was extensive testing, plus a fallback-to-FL1 procedure. But "We started running customer traffic through FL2 early in 2025, and have been progressively increasing the amount of traffic served throughout the year...." As we described at the start of this post, FL2 is substantially faster than FL1. The biggest reason for this is simply that FL2 performs less work [thanks to filters controlling whether modules need to run]... Another huge reason for better performance is that FL2 is a single codebase, implemented in a performance focussed language. In comparison, FL1 was based on NGINX (which is written in C), combined with LuaJIT (Lua, and C interface layers), and also contained plenty of Rust modules. In FL1, we spent a lot of time and memory converting data from the representation needed by one language, to the representation needed by another. As a result, our internal measures show that FL2 uses less than half the CPU of FL1, and much less than half the memory. That's a huge bonus — we can spend the CPU on delivering more and more features for our customers!

Using our own tools and independent benchmarks like CDNPerf, we measured the impact of FL2 as we rolled it out across the network. The results are clear: websites are responding 10 ms faster at the median, a 25% performance boost. FL2 is also more secure by design than FL1. No software system is perfect, but the Rust language brings us huge benefits over LuaJIT. Rust has strong compile-time memory checks and a type system that avoids large classes of errors. Combine that with our rigid module system, and we can make most changes with high confidence...

We have long followed a policy that any unexplained crash of our systems needs to be investigated as a high priority. We won't be relaxing that policy, though the main cause of novel crashes in FL2 so far has been due to hardware failure. The massively reduced rates of such crashes will give us time to do a good job of such investigations. We're spending the rest of 2025 completing the migration from FL1 to FL2, and will turn off FL1 in early 2026. We're already seeing the benefits in terms of customer performance and speed of development, and we're looking forward to giving these to all our customers.

After that, when everything is modular, in Rust and tested and scaled, we can really start to optimize...!

Thanks to long-time Slashdot reader Beeftopia for sharing the article.
Robotics

Researchers Consider The Advantages of 'Swarm Robotics' (msn.com) 30

The Wall Street Journal looks at swarm robotics, where no single robot is in charge, robots interact only with nearby robots — and the swarm accomplishes complex tasks through simple interactions.

"Researchers say this approach could excel where traditional robots fail, like situations where central control is impractical or impossible due to distance, scale or communication barriers." For instance, a swarm of drones might one day monitor vast areas to detect early-stage wildfires that current monitoring systems sometimes miss... A human operator might set parameters like where to search, but the drones would independently share information like which areas have been searched, adjust search patterns based on wind and other weather data from other drones in the swarm, and converge for more complete coverage of a particular area when one detects smoke. In another potential application, a swarm of robots could make deliveries across wide areas more efficient by alerting each other to changing traffic conditions or redistributing packages among themselves if one breaks down. Robot swarms could also manage agricultural operations in places without reliable internet service. And disaster-response teams see potential for swarms in hurricane and tsunami zones where communication infrastructure has been destroyed.

At the microscopic scale, researchers are developing tiny robots that could work together to navigate the human body to deliver medication or clear blockages without surgery... In recent demonstrations, teams of tiny magnetic robots — each about the size of a grain of sand — cleared blockages in artificial blood vessels by forming chains to push through the obstructions. The robots navigate individually through blood vessels to reach a clog, guided by doctors or technicians using magnetic fields to steer them, says researcher J.J. Wie, a professor of organic and nano engineering at Hanyang University in South Korea. When they reach an obstruction, the robots coordinate with each other to team up and break through. Wie's group is developing versions of these robots that biodegrade after use, eliminating the need for surgical removal, and coatings that make the robots compatible with human tissue. And while robots the size of sand grains work for some applications, Wie says that they will need to be shrunk to nano scale to cross biological barriers, such as cell membranes, or bind to specific molecular targets, like surface proteins or receptors on cancer cells.

Some researchers are even exploring emergent intelligence — "when simple machines, following only a few local cues, begin to organize and act as if they share a mind...beyond human-designed coordination."

Thanks to long-time Slashdot reader fjo3 for sharing the article.
Software

Affinity's Image-Editing Apps Go 'Freemium' in First Major Post-Canva Update (arstechnica.com) 8

ArsTechnica: When graphic design platform-provider Canva bought the Affinity image-editing and publishing apps early last year, we had some major questions about how the companies' priorities and products would mesh. How would Canva serve the users who preferred Affinity's perpetually licensed apps to Adobe's subscription-only software suite? And how would Affinity's strong stance against generative AI be reconciled with Canva's embrace of those technologies.

This week, Canva gave us definitive answers to all of those questions: a brand-new unified Affinity app that melds the Photo, Designer, and Publisher apps into a single piece of software called "Affinity by Canva" that is free to use with a Canva user account, but which gates generative AI features behind Canva's existing paid subscription plans ($120 a year for individuals).

This does seem like mostly good news, in the near to mid term, for existing Affinity app users who admired Affinity's anti-AI stance: All three apps' core features are free to use, and the stuff you're being asked to pay for is stuff you mostly don't want anyway. But it may come as unwelcome news for those who like the predictability of pay-once-own-forever software or are nervous about where Canva might draw the line between "free" and "premium" features down the line.

[...] There's now a dedicated page for the older versions of the Affinity apps, and an FAQ at the bottom of that page answers several questions about the fate of those apps. Affinity and Canva say they will continue to keep the activation servers and downloads for all Affinity v1 and v2 apps online for the foreseeable future, giving people who already own the existing apps a way to keep using the versions they're comfortable with. Users can opt to link their Serif Affinity store accounts to their new Canva accounts to access the old downloads without juggling multiple accounts. But those older versions of the apps "won't receive future updates" and won't be able to open files created in the new Canva-branded Affinity app.

Chromium

Unpatched Bug Can Crash Chromium-Based Browsers in Seconds (theregister.com) 24

A critical security flaw in Chromium's Blink rendering engine can crash billions of browsers within seconds. Security researcher Jose Pino discovered the vulnerability and created a proof-of-concept exploit called Brash to demonstrate the bug affecting Chrome, Edge, OpenAI's ChatGPT Atlas, Brave, Vivaldi, Arc, Dia, Opera and Perplexity Comet.

The flaw, reports The Register, exploits the absence of rate limiting on document.title API updates in Chromium versions 143.0.7483.0 and later. The attack injects millions of DOM mutations per second and saturates the main thread. When The Register tested the code on Edge, the browser crashed and the Windows machine locked up after about 30 seconds while consuming 18GB of RAM in one tab. Pino disclosed the bug to the Chromium security team on August 28 and followed up on August 30 but received no response. Google said it is looking into the issue.
Windows

Windows is the Problem With Windows Handhelds (theverge.com) 71

Microsoft shipped its first Xbox handheld nearly two weeks ago. The $600 white Xbox Ally cannot reliably sleep, wake, or hold a charge while asleep. Neither Microsoft nor Asus would admit there's a problem or offer a timeline to fix it after repeated requests by The Verge. Asus said it needs more time to test.

Installing Bazzite, a Linux-based operating system, solves the problems, the publication reports. The same hardware runs games up to 30% faster than Windows and beats the Steam Deck in all but one benchmark. Steam runs more responsively without Windows bloat. The device can be used like a Nintendo Switch, pausing games with the power button and resuming hours or days later. Bazzite initially had sleep issues but fixed them two days after programmer Antheas Kapenekakis obtained the hardware and consulted with two AMD contacts. The black Xbox Ally X, which doesn't have as many sleep issues, gets a similar speed boost with Bazzite.

Two Xbox Ally units tested on Windows repeatedly woke themselves at random intervals. One lost 10% battery after 12 hours of supposed sleep, the other 23%. After another 12 hours, both had only 30% battery remaining. One tried to apply a Windows Update while asleep. Both units refused to wake from sleep at times and required hard resets. Many users have reported similar issues on Reddit with both Xbox Ally versions.

Further reading: Microsoft's Next Xbox Will Run Full Windows and Eliminate Multiplayer Paywall, Report Says.
Youtube

Hackers Used Thousands of YouTube Videos To Spread Malware 15

Hackers have been spreading malware through more than 3,000 YouTube videos advertising cracked software and game hacks, cybersecurity firm Check Point warned this week. The campaign, active since at least 2021, tripled its video production in 2025. The videos promoted free versions of Adobe Photoshop, FL Studio, Microsoft Office, and game cheats for titles like Roblox. Fake comments created the appearance of legitimacy, the researchers found.

Users who downloaded archives from Dropbox, Google Drive, or MediaFire were instructed to disable Windows Defender before opening files. The downloads contained malware including Lumma and Rhadamanthys, which steal passwords and cryptocurrency wallet information. The hackers hijacked existing accounts and created new ones. One compromised channel with 129,000 subscribers posted a cracked Photoshop video that reached 291,000 views. Another video for FL Studio received over 147,000 views.
Microsoft

Microsoft Puts Office Online Server On the Chopping Block 51

Microsoft is retiring Office Online Server on December 31, 2026, ending support and updates for organizations running browser-based Office apps on-premises. The Register reports: After this, there won't be any more security fixes, updates, or technical support from Microsoft. "This change is part of our ongoing commitment to modernizing productivity experiences and focusing on cloud-first solutions," the company said. Office Online Server provides browser-based versions of Word, Excel, PowerPoint, and OneNote for customers who want to keep things on-prem without having to roll out the full desktop applications. Microsoft's solution is to move to Microsoft 365, its decidedly off-premises version of its applications. The company said it is "focusing its browser-based Office app investments on Office for the Web to deliver secure, collaborative, and feature-rich experiences through Microsoft 365."

Other than migrating to another platform when the vendor pulls the plug, affected customers have few options. The announcement will also hit several customers running SharePoint Server SE or Exchange Server SE. While those products remain supported, Office Online Server integration will go away. The company suggested Microsoft 365 Apps for Enterprise and Office LTSC 2024 as alternatives for viewing and editing documents hosted on those servers.

Skype for Business customers will also lose some key features related to PowerPoint. Presenter notes and high-fidelity PowerPoint rendering will go away. In-meeting annotations, which allow meeting participants to write directly to slides without altering the original file, will no longer be available, and embedded video playback will run at lower fidelity. Features like whiteboards, polls, and app sharing shouldn't be affected. Microsoft's solution is a move to Teams, which the company says "offers modern meeting experiences."
Transportation

A SiriusXM Update Sent Some Audi Screens Into a Forced-Reboot Loop For Months (thedrive.com) 29

An anonymous reader quotes a report from The Drive: This week, a reader wrote to us sharing that the infotainment in their 2020 Audi A4 had been "rebooting every five minutes all year." It looks like the problem was caused by a compatibility issue with a SiriusXM app update. Audi tells us the situation's been rectified, but it illustrates a serious pain point in modern cars -- myriad apps interacting with a diverse population of in-car software systems. Our reader was not the only Audi owner affected. "Randomly restarting" Audi infotainment screens have been discussed on Reddit, the Audiworld forum, and elsewhere, going back many months. Audi's recall notice and related service action only went out this summer.

It looks like this particular problem was caused when the satellite radio app pushed an update that was supposed to work on the latest version of Audi's infotainment software, but not all cars were running that. Then SiriusXM reverted, which, I guess, did not solve the problem for every owner. Audi now states that the problem has been fixed and originated with the SiriusXM app, but really, the automaker bears more than a little blame, too. [...] I dropped our own contacts at Audi a note about how and why this might have happened, and they added this clarification: "At the beginning of the year, SiriusXM did a programming update which was addressed via a software update to the MMI. However, as not all customers had their cars updated and SiriusXM then reverted back to the previous category numbering. Nonetheless, a MMI update is recommended as the two versions do seem to cause the issue."

Social Networks

Meta Allows Deepfake of Irish Presidential Candidate To Spread for 12 Hours Before Removal (irishtimes.com) 35

Meta removed a deepfake video from Facebook that falsely depicted Catherine Connolly withdrawing from Ireland's presidential election. The video was posted to an account called RTE News AI and viewed almost 30,000 times over 12 hours before the Irish Independent contacted the platform. The fabricated bulletin featured AI-generated versions of RTE newsreader Sharon Ni Bheolain and political correspondent Paul Cunningham announcing that Connolly had ended her campaign and the election scheduled for Friday would be cancelled.

Connolly responded in a statement that she remained a candidate and called the video a disgraceful attempt to mislead voters. Meta confirmed the account violated its community standards against impersonating people and organizations. Ireland's media regulator Coimisiun na Mean contacted Meta about the incident and reminded the platform of its obligations under the EU Digital Services Act. An Irish Times poll published last Thursday found Connolly leading the race with 38% support.
KDE

KDE Plasma 6.5 Released (kde.org) 13

"Plasma is a popular desktop (and mobile) environment for GNU/Linux and other UNIX-like operating systems," writes longtime Slashdot reader jrepin. "Among other things, it also powers the desktop mode of the Steam Deck gaming handheld. The KDE community today announced the latest release: Plasma 6.5." From the announcement: This fresh new release is all about fine-tuning, fresh features, and a making everything smooth and sleek for everyone. The new version brings automatic light-to-dark theme switching based on the time of day. You can configure which global themes it switches between. You can also configure whether you want the wallpaper to switch between its light and dark versions based on the color scheme, the time of day, or be always light or dark.

Next up is a "Pinned clipboard items" feature, which lets you save text you use regularly into the clipboard. Breeze-themed windows will now have the same level of roundness in all four corners, even the bottom one. Flatpak Permissions page has been transformed into a general Application Permissions page, where you can configure applications' ability to do things like take screenshots and accept remote control requests. The utility that reads the level of ink or toner from your printer now informs you when it's running low or empty.

For the gamers out there, you can now see more relevant info about game controllers on System Settings' Game Controller page. Artists among you can now configure any rotary dials and touch rings on your drawing tablet. Users sensitive to color can now make use of a grayscale color filter, which desaturates or removes color systemwide.

Plasma 6.5 implements support for an experimental version of the Wayland picture-in-picture protocol that promises to allow apps like Firefox to eventually display proper PiP windows that stay above others automatically. Support for "overlay planes" was added, which can reduce CPU usage and power draw when displaying full-screen content using a compatible GPU.
You can read more about these and many other new features in the Plasma 6.5 release announcement and complete changelog.
The Internet

OpenAI Debuts AI-Powered Browser With Memory and Agent Features (chatgpt.com) 28

OpenAI released ChatGPT Atlas on Tuesday, an AI-powered web browser that CEO Sam Altman described as "smooth" and "quick" during a livestream announcement. The browser is available globally on macOS while versions for Windows, iOS, and Android are expected soon. Atlas includes memory features that personalize the browsing experience and an agent mode that allows ChatGPT to perform tasks such as booking reservations and flights or editing documents.

Users can manage these stored memories through the browser's settings and can open incognito windows. The browser displays a split-screen view by default when users click links from search results. The view shows both the webpage and the ChatGPT transcript simultaneously. Atlas also offers webpage summarization and a feature called "cursor chat" that allows users to select text and have ChatGPT revise it inline.
Programming

A Plan for Improving JavaScript's Trustworthiness on the Web (cloudflare.com) 48

On Cloudflare's blog, a senior research engineer shares a plan for "improving the trustworthiness of JavaScript on the web."

"It is as true today as it was in 2011 that Javascript cryptography is Considered Harmful." The main problem is code distribution. Consider an end-to-end-encrypted messaging web application. The application generates cryptographic keys in the client's browser that lets users view and send end-to-end encrypted messages to each other. If the application is compromised, what would stop the malicious actor from simply modifying their Javascript to exfiltrate messages? It is interesting to note that smartphone apps don't have this issue. This is because app stores do a lot of heavy lifting to provide security for the app ecosystem. Specifically, they provide integrity, ensuring that apps being delivered are not tampered with, consistency, ensuring all users get the same app, and transparency, ensuring that the record of versions of an app is truthful and publicly visible.

It would be nice if we could get these properties for our end-to-end encrypted web application, and the web as a whole, without requiring a single central authority like an app store. Further, such a system would benefit all in-browser uses of cryptography, not just end-to-end-encrypted apps. For example, many web-based confidential LLMs, cryptocurrency wallets, and voting systems use in-browser Javascript cryptography for the last step of their verification chains. In this post, we will provide an early look at such a system, called Web Application Integrity, Consistency, and Transparency (WAICT) that we have helped author. WAICT is a W3C-backed effort among browser vendors, cloud providers, and encrypted communication developers to bring stronger security guarantees to the entire web... We hope to build even wider consensus on the solution design in the near future....

We would like to have a way of enforcing integrity on an entire site, i.e., every asset under a domain. For this, WAICT defines an integrity manifest, a configuration file that websites can provide to clients. One important item in the manifest is the asset hashes dictionary, mapping a hash belonging to an asset that the browser might load from that domain, to the path of that asset.

The blog post points out that the WEBCAT protocol (created by the Freedom of Press Foundation) "allows site owners to announce the identities of the developers that have signed the site's integrity manifest, i.e., have signed all the code and other assets that the site is serving to the user... We've made WAICT extensible enough to fit WEBCAT inside and benefit from the transparency components." The proposal also envisions a service storing metadata for transparency-enabled sites on the web (along with "witnesses" who verify the prefix tree holding the hashes for domain manifests).

"We are still very early in the standardization process," with hopes to soon "begin standardizing the integrity manifest format. And then after that we can start standardizing all the other features. We intend to work on this specification hand-in-hand with browsers and the IETF, and we hope to have some exciting betas soon. In the meantime, you can follow along with our transparency specification draft,/A>, check out the open problems, and share your ideas."
Android

GrapheneOS Finally Ready To Break Free From Pixels 35

GrapheneOS, the privacy-focused Android fork once exclusive to Google Pixels, is partnering with a major Android OEM to bring its hardened, de-Googled OS to Snapdragon-powered flagship phones. Android Authority reports: Until now, GrapheneOS has been available only on Pixel phones, making Google's flagships popular among privacy enthusiasts, journalists, and, as a Spanish police report suggested earlier this year, even organized crime groups in Catalonia. But that Pixel exclusivity may end by 2026 or 2027. GrapheneOS revealed in a Reddit thread that it has been working with a "major Android OEM" since June 2025 to enable official support for "future versions of their existing models." These devices will reportedly use flagship Snapdragon chips, a notable shift from Google's in-house Tensor processors.

The project explained that only Pixels have met its strict security and update requirements so far. However, the new partnership suggests that another OEM is finally matching those standards. GrapheneOS also hinted that the mysterious partner's devices will be "priced similarly to Pixels" and available globally as part of the brand's standard lineup.
Windows

Windows 10 Support 'Ends' Today (arstechnica.com) 68

An anonymous reader quotes a report from Ars Technica: Today is the official end-of-support date for Microsoft's Windows 10. That doesn't mean these PCs will suddenly stop working, but if you don't take action, it does mean your PC has received its last regular security patches and that Microsoft is washing its hands of technical support. This end-of-support date comes about a decade after the initial release of Windows 10, which is typical for most Windows versions. But it comes just four years after Windows 10 was replaced by Windows 11, a version with stricter system requirements that left many older-but-still-functional PCs with no officially supported upgrade path. As a result, Windows 10 still runs on roughly 40 percent of the world's Windows PCs (or around a third of US-based PCs), according to StatCounter data.

But this end-of-support date also isn't set in stone. Home users with Windows 10 PCs can enroll in Microsoft's Extended Security Updates (ESU) program, which extends the support timeline by another year. [...] Home users can only get a one-year stay of execution for Windows 10, but IT administrators and other institutions with fleets of Windows 10 PCs can also pay for up to three years of ESUs, which is also roughly the amount of time users can expect new Microsoft Defender antivirus updates and updates for core apps like Microsoft Edge. Obviously, Microsoft's preferred upgrade path would be either an upgrade to Windows 11 for PCs that meet the requirements or an upgrade to a new PC that does support Windows 11. It's also still possible, at least for now, to install and run Windows 11 on unsupported PCs. Your day-to-day experience will generally be pretty good, though installing Microsoft's major yearly updates (like the upcoming Windows 11 25H2 update) can be a bit of a pain.

Android

Android 'Pixnapping' Attack Can Capture App Data Like 2FA Codes (theregister.com) 17

An anonymous reader quotes a report from The Register: Security researchers have resurrected a 12-year-old data-stealing attack on web browsers to pilfer sensitive info from Android devices. The attack, dubbed Pixnapping, has yet to be mitigated. Conceptually, it's the equivalent of a malicious Android app being able to screenshot other apps or websites. It allows a malicious Android application to access and leak information displayed in other Android apps or on websites. It can, for example, steal data displayed in apps like Google Maps, Signal, and Venmo, as well as from websites like Gmail (mail.google.com). It can even steal 2FA codes from Google Authenticator.

"First, the malicious app opens the target app (e.g., Google Authenticator), submitting its pixels for rendering," explained [Alan Wang, a PhD candidate at UC Berkeley]. "Second, the malicious app picks the coordinates of a target pixel whose color it wants to steal. Suppose for example it wants to steal a pixel that is part of the screen region where a 2FA character is known to be rendered by Google Authenticator, and that this pixel is either white (if nothing was rendered there) or non-white (if part of a 2FA digit was rendered there). Third, the malicious app causes some graphical operations whose rendering time is long if the target pixel is non-white and short if it is white. The malicious app does this by opening some malicious activities (i.e., windows) in front of the target app. Finally, the malicious app measures the rendering time per frame of the above graphical operations to determine whether the target pixel was white or non-white. These last few steps are repeated for as many pixels as needed to run OCR over the recovered pixels and guess the original content."

The researchers have demonstrated Pixnapping on five devices running Android versions 13 to 16 (up until build id BP3A.250905.014): Google Pixel 6, Google Pixel 7, Google Pixel 8, Google Pixel 9, and Samsung Galaxy S25. Android 16 is the latest operating system version. Other Android devices have not been tested, but the mechanism that allows the attack to work is typically available. A malicious Android app implementing Pixnapping would not require any special permissions in its manifest file, the authors say.
The researchers detail the attack in a paper (PDF) titled "Pixnapping: Bringing Pixel Stealing out of the Stone Age."
Firefox

Firefox Feature Gets Special Mention In TIME's Best Inventions of 2025 41

Mozilla Firefox's new "Shake to Summarize" feature earned a spot on TIME's Best Inventions of 2025, allowing users to shake their phone to instantly summarize long web pages. Anthony Enzor-DeMeo, general manager of Firefox, calls it a "testament to the incredible work of our UX, design, product, and engineering teams who brought this innovation to life." Neowin reports: Shake to summarize works exactly how you suspect: you physically shake your phone to generate a summary of a long article. This can be quite handy if you are trying to get the gist of a long read without scrolling through the whole thing. Other ways to activate the feature include tapping the thunderbolt icon in the address bar and selecting "Summarize Page" from the three-dot menu.

For now, the feature is limited to iOS users in the US with their system set to English, but Mozilla promises an Android version is in the works. If you have an iPhone 15 Pro or newer running iOS 26, Apple Intelligence generates the summaries on the device. For older iPhones or those on earlier iOS versions, the page text is sent to Mozilla's servers for processing.
You can view the full list of TIME's "Special Mentions" here.
Windows

Microsoft Is Plugging More Holes That Let You Use Windows 11 Without an Online Account 215

Microsoft is eliminating all known workarounds that let users install Windows 11 without an internet connection or Microsoft account, forcing everyone through the online setup process. The Verge reports: "We are removing known mechanisms for creating a local account in the Windows Setup experience (OOBE)," says Amanda Langowski, the lead for the Windows Insider Program. "While these mechanisms were often used to bypass Microsoft account setup, they also inadvertently skip critical setup screens, potentially causing users to exit OOBE with a device that is not fully configured for use."

The changes mean Windows 11 users will need to complete the OOBE screens with an internet connection and Microsoft account in future versions of the OS. Microsoft already removed the "bypassnro" workaround earlier this year, and today's changes also disable the "start ms-cxh:localonly" command that Windows 11 users discovered after Microsoft's previous changes. Using this command now resets the OOBE process and it fails to bypass the Microsoft account requirement.
Businesses

How Europe Crushes Innovation (economist.com) 153

European labor regulations enacted nearly a century ago now impose costs on companies that discourage investment in disruptive technologies. An American firm shedding workers incurs costs equivalent to seven months of wages per employee. In Germany the figure reaches 31 months. In France it reaches 38 months. The expense extends beyond severance pay and union negotiations. Companies retain unproductive workers they would prefer to dismiss.

New investments face delays of years as dismissed employees are gradually replaced. Olivier Coste, a former EU official turned tech entrepreneur, and economist Yann Coatanlem tracked these opaque restructuring costs and found that European firms avoid risky ventures because of them. Large companies typically finance ten risky projects where eight fail and require mass redundancies. Apple developed a self-driving car for years before abandoning the effort and firing 600 employees in 2024. The two successful projects generate profits worth many times the invested sums. This calculus works in America where failure costs remain low. In Europe the same bet becomes financially unviable.

European blue-chip firms sell products that are improved versions of what they sold in the 20th century -- turbines, shampoos, vaccines, jetliners. American star firms peddle AI chatbots, cloud computers, reusable rockets. Nvidia is worth more than the European Union's 20 biggest listed firms combined. Microsoft, Google, and Meta each fired over 10,000 staff in recent years despite thriving businesses. Satya Nadella called firing people during success the "enigma of success." Bosch and Volkswagen recently announced layoffs with timelines stretching to 2030.

Slashdot Top Deals