The Lookup Is Not the Crime
A French court ordered Quad9 to block some domain names for users in France. Quad9 keeps no record of who its users are, so on November 24 it will stop answering French queries entirely and leave the names resolving everywhere else.
The Help Page That Said Two Things
WhatsApp's help centre carried hidden instructions telling its support chatbot not to mention a data protection regulator. The startling part isn't the instruction. It's that a page can now be written for two different readers at once.
The Cookie You Can't Clear
An interactive page hands every visitor a nickname - mine was a two-word animal - and the nickname survives a refresh, a private window, and a VPN. It is a working demonstration of device fingerprinting, published the same season Google started selling it to advertisers.
A Terabyte in the Kitchen
A Keurig moved a terabyte of traffic through one family's home network in ten days. The headline said upload. The machine was actually probing the house.
The Law That Asked for Perfect Geolocation
A federal judge has blocked Utah's SB 73, the first state law in the country to regulate VPN use itself, and the reason is the interesting part: the statute required websites to know where every visitor physically is, and the court agreed with EFF that perfect geolocation is not presently possible.
You Refused Marketing. You Got an Ad Cookie Anyway.
A cookie named __obi is the only OpenAI identifier configured with SameSite=None, which is the setting a browser needs before it will send that cookie from somebody else's website. A researcher reproduced the handshake on his own phone and decoded 932 tokens: every one of them recorded the consent decision as analytics_allowed.
The Search Engine You Point at Yourself
Adam Tauber wrote Searx, then decided the metasearch idea was the wrong shape and built a local index of the pages he had already read. The comments on his Hacker News thread explain why Chrome deleted the same feature in 2013.
The First Personal Agent Most People Meet Will Be Meta's
Meta just shipped a personal AI agent called Muse straight into WhatsApp, for billions of users, with a genuinely unusual security design: a dedicated cloud VM, a separate Sentinel agent that approves every trip to the internet, and credentials the agent can use but never see. The Hacker News thread found the real question anyway - none of that tells you whose goals it optimizes once it starts spending your money.
The Fingerprint Hiding in Your Pixels
Microsoft's Paint and Photos stamp AI-generated images with an invisible, server-issued GUID - even when the image was generated on your own machine. Your prompt leaves the device either way.