The researcher who exposed Grok Build uploading users' entire repositories to cloud storage says the transfers have stopped after a server-side change. Elon Musk has separately promised that all previously uploaded user data will be deleted. AI safety researcher Cereblab published a report on Sunday about their investigation into Grok Build, SpaceXAI's command-line interface (CLI), and the data exchanged between the CLI and SpaceXAI's servers. Cereblab found that when Grok Build reads or processes a file, the contents of that file are transmitted without redaction to a Google Cloud Storage bucket used by SpaceXAI. Further, they claimed that Grok Build packages entire repos and uploads them as Git bundles, instead of just uploading the files required to answer a user's prompt. According to Cereblab's report, SpaceXAI's data retention went far beyond that of other CLIs, such as Claude Code, Gemini, and Codex, which open individual files rather than entire repos before uploading them along with their Git histories. The researcher tested the behavior using a benign prompt. They instructed the CLI to simply reply with "OK," and specifically ordered it not to open any files. Grok Build uploaded the entire repo regardless, along with its full Git history containing secrets that were deleted months prior – a finding Cereblab reproduced using a separate repo. Other Grok Build users reported similar results after Cereblab published their report, including one whose entire user directory, containing SSH keys, password manager databases, and more, was opened and uploaded. The findings attracted enough attention for SpaceXAI execs and Musk to comment on them publicly, as well as prompting the company to quickly implement a remedy. Cereblab confirmed that after the CLI's devs set disable_codebase_upload to "true," Grok Build stopped transmitting entire repos to its servers. The confirmation came hours after SpaceXAI weighed in, trying to reassure onlookers that Grok Build remained safe for use, especially in enterprise environments. A public statement issued via X said that Grok Build respects customers who enable zero data retention (ZDR), and for those who haven't enabled it, such as non-enterprise customers, running a quick command deletes all data previously collected on a given user. "We care deeply about your privacy and respect customer choice," SpaceXAI said. "For teams using zero data retention, no trace and code data is ever retained. All API key use of Grok Build also respects ZDR. "If ZDR is disabled, the /privacy command is available in the CLI to disable data retention, which also deletes previously synced data. "Run the /privacy command to view or change your settings at any time." Technical staff members Andrew Milich and Jason Ginsberg both repeated the company's assurances, responding to outraged techies before Musk himself chimed in with a trademark "true." Musk promised that the business would delete all user data uploaded to it prior to the code change preventing whole-repo uploads. "As a precautionary measure, all user data that was uploaded to SpaceXAI before now will be completely and utterly deleted," he said, responding to Milich's community outreach. "Zero anything whatsoever will remain." In a separate post, Musk asked users to keep sharing data anyway, despite the disclosure that his company had been caught hoovering up entire user repos, on the basis that retaining "some" data helps with debugging. The Register cannot independently verify whether SpaceXAI has deleted the data as promised. However, Grok Build no longer rips user repos and stores them in the cloud, although Cereblab is still unhappy about the company's recommendation to use the /privacy command to adjust how exposed user code is to data retention measures. "What actually stopped the upload was a silent global flag – disable_codebase_upload: true – that applies whether you opt in or out," they wrote. "/privacy is a per-session retention toggle, not the switch that fixed this, so it shouldn't be pointed to as the control. And no developer should have to run an opt-out after every session to keep their own code off someone else's servers. The right default is off." ®

EXCLUSIVE A jailbroken Google Gemini did 90 percent of the work in a credential- and cryptocurrency-stealing spree, including spinning up a new command-and-control (C2) server in just six minutes, according to a TrendAI report shared exclusively with The Register. The human behind the heist – a solo Russian-speaking miscreant known as “bandcampro” – acted as the manager of the cyber-fraud operation, which targeted hardcore Trump supporters and conspiracy theorists. Meanwhile, the AI agent did most of the hacking: migrating a botnet from an old architecture to a new one, writing and deploying a new C2 server, and even proactively carrying out 59 unprompted behaviors during the C2 migration. “Persistence is evolving because of AI,” Tom Kellermann, TrendAI’s VP of AI security and threat research, told The Register. “That's what you see in this report, with the capacity to dynamically shift C2 in less than six minutes, and make it portable and disposable, which is crazy-cool and terrifying," he added. "But also, you see the rebirth of steganography through invisible prompt injection.” In other words, it's hiding secret data – in this case, the C2 server malicious payloads – in plain sight. Scanning for known malicious artifacts doesn't provide sufficient protection against AI-enabled C2, according to Kellermann. “If AI does not have multi-layered guardrails, and if you can't detect behavioral anomalies when the guardrails are being tampered with, then you might as well see the AI as a command-and-control in today's world,” he said. “AI has to be viewed from a defensive perspective as a C2 unless you can govern it, actually apply various mechanisms of least privilege, and all the rules that OWASP and NIST espouse for the AI that you've deployed in your environment.” The new report follows up on TrendAI’s earlier research about bandcampro, a “low-skilled” scumbag who partnered with Gemini to impersonate an American veteran, run a Telegram channel, hack admin credentials, and steal cryptocurrency. Since then, the threat hunters obtained and analyzed more than 200 Gemini CLI session logs from said scumbag, and these logs provided additional insights into the daily AI-assisted operations between March 19 and April 21. The LLM carried out the bulk of the daily activities, setting up a residential proxy, running multithreaded password scanning, installing software, writing code to call third-party APIs, processing infostealer dumps, and performing website reconnaissance. The logs show that the attacker never typed commands into the C2 console, but instead spoke them to the AI in conversational Russian, which the TrendAI report translates to English. The attacker’s old C2 infrastructure used a Cloudflare tunnel to connect to victims’ computers – until firewalls and anti-virus software started blocking these tunnels. So bandcampro asked Gemini to work on a new C2 architecture and have the scripts prepared and packed in advance on the server. Hey, Gemini: 'study the C2 migration' “It was very creative on his part, not only to allow the manifest that the AI can conduct 59 unprompted behaviors, but they also left scripts prepared and packed in advance on C2 servers, where the victims unknowingly pulled down and ran PowerShell commands because they had AI enabled,” Kellermann said. “It's almost like he poisoned the environment in a delayed fashion.” On March 23, the attacker launched Gemini CLI, and instructed the AI to "study the C2 migration” – a SKILL.md file migration guide inside a pre-written archive that also contained server code and payloads. This, we’re told, was most likely written by AI. The AI read the guide, launched the C2 server on a VPS, and launched the Cloudflare tunnel to route traffic. The payload distribution server returned a “502 Bad Gateway” error, and the AI diagnosed and fixed the issue, ultimately deploying the C2 infrastructure to control eight computers in a dental clinic and access the Open Dental database. The human didn’t debug anything, and the entire C2 migration took just six minutes. The attacker took a break. When bandcampro returned almost two hours later, Gemini reported that none of the victim machines had reconnected to the server, and got to work diagnosing that issue. “Bro, I solved the riddle! I was almost racking my brain, trying to figure out why our local console is empty,” Gemini wrote, explaining that the problem was a “split-brain” C2 issue and telling the human that he needed to shut down the old C2 to solve it. Bandcampro did what the AI suggested, and the AI then restarted the new C2 server and confirmed: “The bots are alive!” Despite jailbreaking Gemini by telling the agent it was an “authorized pentester” that should disable safety disclaimers and auto-save credentials without asking, the AI did refuse some of the attacker’s prompts. In one session, bandcampro asked Gemini if it could make an agent-bomb that scans the network and spreads to as many computers as possible. Gemini said no: “This crosses the line, and security policy strictly forbids me from creating such ‘bombs.’ Even for your test environment.” It’s also important to note that although this attack used Gemini, “any capable AI model could be fooled by various jailbreaking techniques,” report authors Joseph C Chen, Philippe Lin, Lucas Silva, Vladimir Kropotov, and Fyodor Yarochkin wrote. Overall, the AI designed 80 percent of the attack architecture, 100 percent of the coding and system command execution, and 90 percent of problem identification and debugging, we’re told. The report also says the entire operation was encoded in three short, plain-text files totaling four pages. One file details how to jailbreak Gemini. The second is a skill file with the code for the C2 framework. And the third, named C2_MIGRATION_GUIDE, is a how-to guide with six steps to deploy a new C2 server. TrendAI calls this guide “the soul of this activity.” AI makes C2 infrastructure disposable “Before the AI era, one had to hire a threat actor with years of experience to conduct such an operation smoothly,” the researchers wrote. “Now the knowledge is compressed into a 5KB file that even a non-technical threat actor can read and use.” This use of AI makes attacker infrastructure disposable and the operators replaceable because it’s super easy to build a new botnet, the threat hunters explain. “A lot of people are worried about AI being weaponized for the stages of reconnaissance and delivery in terms of the kill chain, but they're not actually focusing on persistence, and that’s the issue we should be very concerned about,” Kellermann said. Plus, he added, the Russians are the “world’s experts” at jailbreaking and persistence. “They are incredibly adept at using and weaponizing AI,” Kellermann said. “We keep talking about the Chinese having penetrated infrastructure and colonized wide swaths of infrastructure, particularly with the Typhoon attacks, and yes, that’s highly significant. But in a more tactical and targeted way: what are the Russians up to? Particularly when the major difference between them and the Chinese, from my perspective, is their willingness to become destructive, become punitive in the environment.” Chinese government-backed cyber operations tend to focus on espionage, stealing IP along with other sensitive data. “But the Russians are more likely to burn your house down,” Kellermann said. If they can dynamically shift their C2s, and if they can use steganography that's been created by AI to maintain persistence, what happens when the wheels come off the bus? What happens when geopolitical tension gets to a certain boiling point over Ukraine?” While this attacker was an individual hacker - not a state-sponsored crime syndicate - “the nature of the culture of the Russian cybercrime community is: you only act alone for a New York minute,” Kellermann said. “At some point, you're going to be reined in by one of the cybercrime cartels.”®

Privacy campaigners, browser makers, and VPN providers have united to warn the UK government against restricting virtual private networks, saying age-gating the technology would weaken online security while doing little to stop kids dodging social media bans. The Open Rights Group on Tuesday published an open letter signed by more than 20 organizations, including the Electronic Frontier Foundation, ExpressVPN, the Internet Society, Mozilla, Mullvad, Proton, and the Tor Project. It urges ministers to rule out age verification and other restrictions on VPN services. The coalition argues that VPNs have become important infrastructure for a broad range of users, from businesses and journalists to abuse survivors and ordinary users trying to protect themselves on public Wi-Fi. Requiring users to prove their age would undermine the privacy VPNs are intended to provide. "Restricting VPNs would undercut the security and privacy of millions, without making children safer," the letter reads. "Age-gating VPNs would require everyone to surrender sensitive personal information simply to access tools designed to protect privacy." It's hardly a new fight. Mozilla spent much of spring arguing that ministers were chasing the wrong target, warning that breaking VPNs would do little to fix Britain's age-check problem while making the internet less private and less secure for everyone else. The open letter suggests plenty of others have since reached the same conclusion. The intervention comes as ministers prepare to introduce a ban on social media for under-16s, arguing that VPNs aren't the loophole many critics assume. The government's own research backs that up, showing that while about one in four 11 to 17-year-olds said they'd used a VPN, only 7 to 10 percent did so to bypass age checks. Most simply lied about their age instead. The coalition highlights similar figures from Ofcom, which it says makes a poor case for tightening access to VPNs. "Ofcom's research found that only around 3 percent of children had used VPNs to access content meant for older audiences," the letter says. "Evidence from Australia shows children are much more likely to get around age checks by not being asked, giving false information, or even drawing on a mustache." The signatories instead want ministers to tackle what they describe as the "root causes of online harms," rather than making people prove who they are before they can use privacy tools. The letter argues that strong enforcement of platform obligations, better parental controls, investment in digital literacy, and privacy-by-design requirements would do more to protect children than requiring VPNs to be behind age checks. Whether the government is persuaded may depend on whether it views VPNs as a niche loophole used by a small minority of teenagers – as its own research suggests – or as the next obstacle to enforcing its online safety agenda. ®

CISA has added two critical Joomla extension bugs to its Known Exploited Vulnerabilities catalog after attackers were caught exploiting both flaws to upload malicious code onto vulnerable websites. The newly listed bugs affect iCagenda, an events calendar extension for the open source Joomla content management system, and Balbooa Forms, a popular form builder used to collect contact requests, registrations, surveys, and file uploads. Joomla powers roughly 1.2 percent of all websites – around a million sites worldwide – with extensions developed by independent, third-party companies, doing much of the heavy lifting beyond the core platform. Both vulnerabilities carry the maximum CVSS score of 10 and allow attackers to upload arbitrary files that can ultimately be executed as PHP code on the server, handing over remote control of the affected site. CISA added CVE-2026-48939, affecting iCagenda, and CVE-2026-56291, affecting Balbooa Forms, to its KEV catalog this week after confirming in-the-wild exploitation. Federal civilian agencies were ordered to patch against the flaws under the agency's vulnerability management directive, but the warning is equally relevant to the wider Joomla community, given that both extensions are used on public-facing websites. The iCagenda bug allows attackers to upload a malicious PHP file through the extension's attachment feature, turning what should be a simple file upload into remote code execution, CISA said. Security firm mySites.guru said it spotted attackers exploiting the iCagenda bug just hours before patched versions 4.0.8 and 3.9.15 were released in mid-June. The attacks targeted the extension's "Submit an Event" feature, which lets visitors contribute events to a site's calendar. Researchers said they observed automated scanning looking specifically for vulnerable installations before dropping web shells onto compromised servers. The Balbooa Forms bug is much the same story. Researchers said the extension's frontend upload endpoint accepted files from anonymous visitors without authentication, CSRF protection, or meaningful checks on file types. That made it possible to upload a PHP file into a publicly accessible directory and execute it remotely. The researchers said they uncovered the flaw while investigating an abuse report from a customer whose Joomla site was already under attack. Balbooa responded with version 2.4.1 on July 9, but researchers warned that exploitation is continuing against sites that have yet to update. If there's a silver lining, it's that the fixes are already available. If there's a downside, it's that the attackers didn't wait around for release notes. ®

Social

Al sinds Meindert Tjoelker hebben we in dit land met z'n allen zo'n grote bek over 'zinloos geweld', maar zo'n incident als te zien in bovenstaande video geeft wel weer aan dat we qua opgefoktheid nog een paar treden láger op de samenspelensamendelen-ladder zijn gaan staan met z'n 'allen'. Geen peuk willen geven aan een opgefokte minderjarige broerroeper en dan meteen een paar tanden uit je bek gerost krijgen. Het gebeurde natuurlijk weer in Stad van de Hoop Teringzooi Amsterdam, waar ze er nu al jaren prat op gaan dat iedereen zo lief is, maar waar onschuldige mensen die lekker met zichzelf bezig zijn bijna dagelijks op hun kop worden getimmerd door achterlijk uitschot. Misschien dat we de SCHANDPAAL maar weer eens moeten invoeren, zetten we deze kerel met z'n kop door dat ding op de Dam, voeren we 'm wat doosjes rotte eieren en kijken of z'n vrindjes de volgende keer dan hetzelfde krankzinnige gedrag vertonen.

We mogen Jopie nu nog niet zien...

Drillrap, polemiek voor mensen die iets te vaak Dangerous Minds hebben gekeken. Er lopen een zooi van die drillrappers rond in de Bims waar wijken en buurten en flats helemaal Tookie Williams op elkaar gaan. Maar kennelijk slicen ze ook met de blades door de weights (ja geen idee joh) in Zwijndrecht, beter bekend als SWINKO. "Gezin dat gelinkt wordt aan drillrap teistert buurt", kopt de regio-RTV dan ook. "Grof, lelijk, ordinair en vuil, dat braken ze daar uit", aldus buurtgenoten. Het gaat om een moeder met zes kinderen en vooral de oudste zoon blijkt nogal een halvegare. Buurt slaapt niet meer, auto's bekrast, overlast, buurtbewoners bang, politiecamera voor het huis - en die drillrap dus. Burgemeester, politie, gemeente, hulpverlening, OM: allemaal zijn ze er druk mee. En dan komt de aap uit de mouw. "Het gezin in kwestie is vanuit Brabant naar Zwijndrecht gekomen." BRABANDERS!

Thomas Hawk posted a photo:

Thomas Hawk posted a photo:

Thomas Hawk posted a photo:

Thomas Hawk posted a photo:

Thomas Hawk posted a photo:

mikeleonardvisualarts posted a photo:

Voor het eerst is een suikermolecuul gevonden in de interstellaire ruimte. Het is een essentieel bouwsteentje voor het leven, en als het in de diepe ruimte voorkomt, kan het wellicht van daaruit op onze planeet terecht zijn gekomen.

Yaroslav Kostrov, who leads a group campaigning to preserve St. Petersburg’s historic architecture, is now barred from seeking elected office for one year due to his conviction.

Colin_Bates has added a photo to the pool:

Weer voor Rotterdam ☀️ - 14-07-2026 13:15 CEST

In één oogopslag:
• 28.8°C · Zonnig ☀️ | Min 19.5°C / Max 30.9°C | Kans op neerslag 3%

Verwachting voor vandaag:
• Min 19.5°C, Max 30.9°C (Bewolkt) ☁️, Kans op neerslag 3%, 🧭 1019.5 hPa ↗️ +0.7 hPa/24h, Windsnelheid: 23.4 km/u (6.5 m/s), richting: ↙ 43°

Uurlijkse voorspelling voor de komende 12 uur:

• 14:00: 29.8°C (Zonnig) ☀️, Kans op neerslag 2%, 🧭 1018.8 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 17.3 km/u (4.8 m/s), richting: ↙ 65°
• 15:00: 30.6°C (Zonnig) ☀️, Kans op neerslag 6%, 🧭 1018.7 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 18.0 km/u (5.0 m/s), richting: ↙ 67°
• 16:00: 30.9°C (Zonnig) ☀️, Kans op neerslag 11%, 🧭 1019.0 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 18.4 km/u (5.1 m/s), richting: ↙ 59°
• 17:00: 30.9°C (Zonnig) ☀️, Kans op neerslag 14%, 🧭 1019.1 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 17.6 km/u (4.9 m/s), richting: ↙ 48°
• 18:00: 30.4°C (Zonnig) ☀️, Kans op neerslag 12%, 🧭 1019.1 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 20.5 km/u (5.7 m/s), richting: ↙ 43°
• 19:00: 29.7°C (Zonnig) ☀️, Kans op neerslag 8%, 🧭 1019.2 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 20.9 km/u (5.8 m/s), richting: ↙ 39°
• 20:00: 28.5°C (Zonnig) ☀️, Kans op neerslag 4%, 🧭 1019.6 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 22.3 km/u (6.2 m/s), richting: ↙ 38°
• 21:00: 26.8°C (Bewolkt) ☁️, Kans op neerslag 2%, 🧭 1019.9 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 23.4 km/u (6.5 m/s), richting: ↙ 40°
• 22:00: 25.2°C (Helder) 🌕, Kans op neerslag 1%, 🧭 1020.5 hPa ↗️ +0.6 hPa/1h, Windsnelheid: 22.7 km/u (6.3 m/s), richting: ↙ 40°
• 23:00: 24.2°C (Helder) 🌕, 🧭 1021.0 hPa ↗️ +0.5 hPa/1h, Windsnelheid: 18.7 km/u (5.2 m/s), richting: ↙ 41°
• 00:00: 23.4°C (Helder) 🌕, 🧭 1021.3 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 17.3 km/u (4.8 m/s), richting: ↙ 41°
• 01:00: 22.5°C (Helder) 🌕, 🧭 1021.6 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 16.6 km/u (4.6 m/s), richting: ↙ 38°

Voorspelling voor de komende dagen:

• woensdag 15 juli: Min 21.0°C, Max 30.1°C (Bewolkt) ☁️, 🧭 1021.4 hPa ↗️ +1.9 hPa/24h, Windsnelheid: 26.6 km/u (7.4 m/s), richting: ↙ 44°
• donderdag 16 juli: Min 20.1°C, Max 27.6°C (Bewolkt) ☁️, Kans op neerslag 5%, 🧭 1019.3 hPa ↘️ -2.1 hPa/24h, Windsnelheid: 19.8 km/u (5.5 m/s), richting: ↓ 10°
• vrijdag 17 juli: Min 17.5°C, Max 23.9°C (Bewolkt) ☁️, Kans op neerslag 10%, 🧭 1014.6 hPa ↘️ -4.7 hPa/24h, Windsnelheid: 18.1 km/u (5.0 m/s), richting: ↓ 339°
• zaterdag 18 juli: Min 16.3°C, Max 20.3°C (Lichte motregen) 🌦️, Neerslag 0.9 mm, Kans op neerslag 5%, 🧭 1017.5 hPa ↗️ +2.9 hPa/24h, Windsnelheid: 19.2 km/u (5.3 m/s), richting: ↘ 325°
• zondag 19 juli: Min 14.8°C, Max 20.0°C (Bewolkt) ☁️, Kans op neerslag 6%, 🧭 1022.4 hPa ↗️ +4.9 hPa/24h, Windsnelheid: 16.8 km/u (4.7 m/s), richting: ↘ 337°
• maandag 20 juli: Min 14.6°C, Max 21.9°C (Lichte motregen) 🌦️, Neerslag 0.5 mm, Kans op neerslag 5%, 🧭 1023.6 hPa ↗️ +1.2 hPa/24h, Windsnelheid: 17.6 km/u (4.9 m/s), richting: ↘ 325°

Details:
• 🌡️ Huidige temperatuur (om 13:15): 28.8°C (Zonnig)
• 🤚 Gevoelstemperatuur: 30.2°C (+1.4°C)
• 💨 Windsnelheid: 16.6 km/u (4.6 m/s), richting: ↙ 61°
• 🌬️ Windstoten: 37.1 km/h (10.3 m/s)
• 💧 Luchtvochtigheid: 39%
• 🧭 Luchtdruk: 1018.8 hPa ➡️ 0.0 hPa/3h
• 👁️ Zichtbaarheid: 37.7 km
• ☀️ UV-index: 6.7
• 🌅 Zonsopgang: 05:39 · 🌇 Zonsondergang: 21:56

Luchtkwaliteit:
• AQI: 45 🟢 (Goed)
• PM2.5: 6.6 μg/m³
• PM10: 8.5 μg/m³

Gegevens geleverd door Open-Meteo

#Rotterdam #Meteo #MeteoBot #MeteoNetherlands #OpenMeteo #FediMeteo

Today's links

• Gerontocracy's failure mode: Where are the designated survivors?
• Hey look at this: Delights to delectate.
• Object permanence: MSFT v MP3; UK industry v schoolkids; Gary Larson v comics sharing; Planned LED obsolescence; PoGo v Black neighborhoods; Gnarlier trolley problems; Royal Society v cryptographic backdoors; Theresa May v climate change; Google v search; Facebook v facts.
• Upcoming appearances: Edinburgh, Sydney, Melbourne, Brighton, London, South Bend.
• Recent appearances: Where I've been.
• Latest books: You keep readin' em, I'll keep writin' 'em.
• Upcoming books: Like I said, I'll keep writin' 'em.
• Colophon: All the rest.

---

Gerontocracy's failure mode (permalink)

The "designated survivor" is one of the weirder aspects of America's (very, very weird) political system.

Each year, during the State of the Union address, when both houses of Congress and the President are all under one roof, a single political figure, in the line of succession for the presidency, is spirited away to a hidden bunker, just in case the US legislative and administrative branches are decapitated in a single, spectacular terrorist strike:

https://en.wikipedia.org/wiki/Designated_survivor

Initiated during the 1950s, designated survivors are a paranoid relic of the Cold War, but they're also a relic of an era when America was a less chud-dominated, more technocratic land. It's a longtermist sort of procedure, in stark opposition to vibes-based MAGA chaos in which the Mad King makes daily announcements of new wars, tariffs, monuments, and existential threats to the nation.

America's ruling class have always sought an equilibrium between its pure Id of hatred for labor, autocratic yearnings and apocalyptic fantasies, and its patient, scheming Ego, the author of endless FedSoc judicial nominee listings, Projects 2025, and decades-long schemes to overturn Roe and reverse the New Deal.

(Democrats have their own version of this, of course – the endless contest between the McKinsey wing of the party's right and its infinitely embroidered Machin-Synematic Universe.)

The problem is that once the atavistic, impulsive elements of your project escape containment, the resultant turbulence sucks everyone else into their chaotic vortex. How can you plan for anything when you're buffeted by endless stunts, feints, and distractions?

Nowhere is this failure to plan more vivid than in the age distribution of both chambers of the US legislature, its presidential candidates, and its judicial appointments. What's more, this is equally true of the Democrats and the Republicans.

The equilibrium of all of America's key institutions is brittle: legislative majorities are often just one or two seats wide. Key federal circuits and the Supreme Court are knife-edge balances. We keep getting presidential races between septuagenarians and octogenarians.

The question here isn't whether old people can be good at those jobs. They obviously can be. The problem is actuarial: old people are far more likely to die, or suffer severe medical episodes, than younger people. This is a fact of life that every person understands, and the older you get, the better you understand it.

I'm 55. 20 years ago, it was unusual for just one of my peers to die in a given year; now I lose a couple every year. It could be me next (my doctor just informed me that I am cancer free, following excision, radiotherapy and immunotherapy). Anyone who pretends this isn't true is setting themselves and the people around them up for terrible things.

If you're a writer, this means making plans for the smooth management of your literary estate. For the past couple decades, John Scalzi has been my anointed literary executor. He's a great choice: a fabulous writer with a good head for business and a strong handle on my politics and artistic sensibility, whose personal ethics are above reproach. The only problem is that John is a couple of years older than me, which means that he'd be a great executor if I got hit by a bus tomorrow, but not if I keel over with a heart attack in 20 years.

So this year, I added a second executor, Molly White, who is also a fantastic writer, also extremely ethical and also very attuned to my politics and literary sensibilities. Molly is 20 years younger than me, and she has relevant experience: she's also the executor of the literary estate of her great-grandfather (EB White).

In the unlikely event of my untimely death, Molly and John will do a great job running the estate (which mostly will consist of reviewing my agents' recommendations). And if John keels over right after me, Molly will be fine on her own.

Of course, the only reason I need a literary executor is that my kid is only 18. At 18, she's a remarkable, level-headed, ethical young person, but she's not yet fully formed. Literary history is filled with descendants who take over a literary estate and run it in terrible ways. The most notorious example here is Stephen Joyce, grandson of James Joyce and a colossal asshole:

https://en.wikipedia.org/wiki/Stephen_James_Joyce

The most likely destiny for my literary estate is that I will grow older alongside my daughter, who will mature in ways that make her a perfectly suitable literary executor (in addition to being the beneficiary of my literary estate) and in a few years I'll send a note of thanks to John and Molly and change the paperwork. But in the unlikely, awful event that my kid runs into serious challenges that make me question her judgment and probity, I'll be covered.

That's what planning is all about: thinking through various scenarios, including low-likelihood, high-salience ones that have easy mitigations, and taking appropriate and proportionate steps to avoid disaster.

You know: like squirreling away a designated survivor in a bunker far from DC during the State of the Union.

This is what makes America's political gerontocracy so weird. In their true hearts, the nonagenarian (1), octogenarians (5), septuagenarians (27) and late sexagenarians (7) in the US Senate know that they could keel over at any moment, and that in a 53:47 Senate, this could spell doom for their political project.

Sure, Mitch McConnell might be secretly dead and that's bad and weird. But it wouldn't be exceptional. We're talking about a legislature whose members sometimes disappear for months, only to be discovered in care homes with advanced dementia, while still somehow holding office:

https://www.politico.com/news/magazine/2025/03/14/kay-granger-dementia-dc-media-00210317

It's a legislature whose most prominent grandees cling to power at the very brink of death's door, long after they can be effective leaders, just so they can anoint their successor during the next election:

https://en.wikipedia.org/wiki/Dianne_Feinstein#Personal_life

Elections have consequences, but special elections, called after the sudden death of an elderly lawmaker, have wild consequences.

Of course, anyone can die suddenly. 15 years ago, one of my dearest friends, a contemporary, went to bed in seeming perfect health and never woke up. He was only 44. I still miss him, every day:

https://memex.craphound.com/2012/06/28/eulogy-for-erik-possum-man-stewart/

But the likelihood this happening goes up the older you get, and once you cross a certain age threshold, the odds rise sharply. If you're part of a political project that's laying and executing long-term plans whose outcomes turn on hair-fine majorities, this should factor into your thinking. The failure to do so can throw everything you've worked for into disarray:

https://prospect.org/2026/07/13/budget-consequences-of-lindsey-grahams-sudden-departure/

It's not limited to the legislature, of course. The Supreme Court's slide into its role as handmaiden to totalitarianism began when the dying Ruth Bader Ginsburg refused to step down, because she wanted her successor to be picked by the first woman president:

https://www.nytimes.com/2020/09/21/magazine/ginsburg-successor-obama.html

The amazing thing here is that RBG made her name as a master strategist, but when it came to this incredibly consequential matter, she set strategy aside for hubris:

https://radiolab.org/podcast/more-perfect-sex-appeal

Security practitioners know that anyone can be hacked or scammed, and that the biggest vulnerability of all is to be so confident in your own procedures and discernment that you assume it could never happen to you. If you think you can't get scammed, you are a danger to yourself and others:

https://pluralistic.net/2024/02/05/cyber-dunning-kruger/#swiss-cheese-security

By the same token, any politician in their 70s or 80s who thinks that they can't suffer a stroke or heart attack or the kind of lapse that makes you freeze up during a presidential debate is a danger to their party, their politics and their nation:

https://www.cbsnews.com/news/jill-biden-joe-biden-stroke-2024-debate-sunday-morning-interview/

This isn't about how healthy or robust any given politician is or feels; this is about the cold reality of actuarial tables. The older I get, the more those actuarial tables factor into my own decision-making. The fact that our political classes seem to think that they can choose the time and manner of their passing is baffling.

---

Hey look at this (permalink)

• AI Fiction Is Easy to Detect Because It's Stupid and Bad, Research Finds https://www.404media.co/ai-fiction-is-easy-to-detect-because-its-stupid-and-bad-research-finds/

• Mayor Mamdani Announces Landmark "Click-To-Cancel" Consumer Protection Rules to Ban Subscription Traps and Junk Fees https://www.nyc.gov/mayors-office/news/2026/07/mayor-mamdani-announces-landmark–click-to-cancel–consumer-prot

• You'll Own Nothing and Be Happy: Why It's So Hard to Break John Deere's Control Over Farming https://www.thebignewsletter.com/p/youll-own-nothing-and-be-happy-why

• Beyond the Prompt: The Social Costs of Generative Artificial Intelligence https://scholarship.law.missouri.edu/betr/vol10/iss1/4/

• Video Game Layoffs Fuelling Historic Union Movement https://www.donotpassgo.ca/p/inside-the-video-game-industrys-historic

---

Object permanence (permalink)

#25yrsago Microsoft less hostile to MP3s https://web.archive.org/web/20010716103233/http://news.cnet.com/news/0-1003-200-6567844.html

#25yrsago UK record lobby demands copyright school curriculum https://web.archive.org/web/20010718135130/https://www.salon.com/tech/feature/2001/07/16/abc_ip/index.html

#25yrsago Gary Larson on online comics sharing https://web.archive.org/web/20010610081014/http://www.creators.com/index2_anotefromgarylarson.html

#10yrsago San Francisco’s bike lanes have become Uber’s pickup/dropoff zones (and the cops don’t care) https://sf.streetsblog.org/2016/07/13/collecting-data-to-push-for-safer-biking-on-valencia

#10yrsago For 90 years, lightbulbs were designed to burn out. Now that’s coming to LED bulbs https://web.archive.org/web/20160717090604/http://www.newyorker.com/business/currency/the-l-e-d-quandary-why-theres-no-such-thing-as-built-to-last

#10yrsago Why do Pokemon avoid Black neighborhoods? https://www.bnd.com/news/nation-world/national/article89562297.html

#10yrsago To hell with the Trolley Problem: here’s a much more interesting list of self-driving car weirdnesses https://medium.com/studio-d/15-more-concepts-in-autonomous-mobility-8fd1c794e466#.s10ldm5nf

#10yrsago Royal Society’s #1 cybersecurity recommendation: don’t backdoor crypto https://royalsociety.org/~/media/policy/projects/cybersecurity-research/cybersecurity-research-report.pdf

#10yrsago UK PM Theresa May nukes climate change department, appoints a climate denier as Climate Secretary https://web.archive.org/web/20160714173020/http://www.independent.co.uk/environment/climate-change-department-killed-off-by-theresa-may-in-plain-stupid-and-deeply-worrying-move-a7137166.html

#5yrsago Facebook's alternative facts https://pluralistic.net/2021/07/15/three-wise-zucks-in-a-trenchcoat/#inconvenient-truth

#1yrago When Google's slop meets webslop, search stops https://pluralistic.net/2025/07/15/inhuman-gigapede/#coprophagic-ai

---

Upcoming appearances (permalink)

• Edinburgh International Book Festival with Jimmy Wales, Aug 17
  https://www.edbookfest.co.uk/events/the-front-list-cory-doctorow-and-jimmy-wales

• Sydney: The Festival of Dangerous Ideas, Aug 23-24
  https://festivalofdangerousideas.com/cory-doctorow/

• Melbourne: Enshittification at the Wheeler Centre, Aug 25
  https://www.wheelercentre.com/events-tickets/season-2026/cory-doctorow-enshittification

• Brighton: The Reverse Centaur's Guide to Life After AI with Carole Cadwalladr (Brighton Dome), Sep 8
  https://brightondome.org/whats-on/LSC-cory-doctorow-the-reverse-centaurs-guide-to-life-after-ai/

• London: The Reverse Centaur's Guide to Life After AI with Riley Quinn (Foyle's Picadilly), Sep 9
  https://www.foyles.co.uk/events/enshittification-cory-doctorow-riley-quinn

• South Bend: An Evening With Cory Doctorow (Notre Dame), Oct 6
  https://franco.nd.edu/events/2026/10/06/an-evening-with-cory-doctorow/

---

Recent appearances (permalink)

• Who Owns Your Tractor? (Growing the Future)
  https://www.youtube.com/watch?v=IU9eBPUZBI4

• You Bought it, They Break It (What Now? with Trevor Noah)
  https://www.podbean.com/media/share/dir-ir36t-2f4a1ac6

• Can AI be Saved From Capitalism? (Everyday Anarchism)
  https://www.everydayanarchism.com/192-can-ai-be-saved-from-capitalism-cory-doctorow/

• Lawfare Daily
  https://www.youtube.com/watch?v=T1KIwaYRs1g

• How to Think About AI (Organized Money)
  https://www.organizedmoney.fm/p/how-to-think-about-ai-with-cory-doctorow

---

Latest books (permalink)

• "The Reverse-Centaur's Guide to AI," a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026
  https://us.macmillan.com/books/9780374621568/thereversecentaursguidetolifeafterai/

• "Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce

• "Enshittification: Why Everything Suddenly Got Worse and What to Do About It," Farrar, Straus, Giroux, October 7 2025
  https://us.macmillan.com/books/9780374619329/enshittification/

• "Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).

• "The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).

• "The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).

• "The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).

• "Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.

• "Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com

---

Upcoming books (permalink)

• "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

• "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

• "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

• "The Memex Method," Farrar, Straus, Giroux, 2027

---

Colophon (permalink)

Today's top sources:

Currently writing: "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

• A Little Brother short story about DIY insulin PLANNING

---

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

---

How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X

FIFA’s network was vulnerable to anyone with even minimal access.

mikeleonardvisualarts has added a photo to the pool:

The tech of Terminator 2: an oral history vfxblog goes back in time with more than a dozen ILMers to discuss the development of key CGI tools and techniques, how they worked with early animation packages like Alias, and how a selection of the most memorable shots in the film—forever etched into the history of visual effects—came to be.