Malwarebytes:

If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.

[…]

Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.

[…]

The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.

Adam Engst:

Expect to see numerous websites go down or serve “Page not found” errors as they update PHP, the programming language that underpins 70% of websites. If you run a WordPress, Drupal, or Joomla site, this affects you directly.

Nick Heer:

Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s php.ini file, it might be worth turning off multipart uploads for now.

Vincent Schmalbach:

Two changes reduce the risk until the fixed versions are out. They were checked against PHP’s source code and the PHP manual, but they are not an official PHP mitigation. When someone suggested that turning off session upload progress might be enough, PHP core developer Gina Peter Banyard replied, “The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.” Use the stopgaps to lower the risk for a few hours, and update PHP as soon as the fixed builds exist.

Add to php.ini:

session.upload_progress.enabled = Off

Add to .htaccess:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Guido Fawkes:

Ofcom boss Dame Melanie Dawes has admitted today that tech firms have paid just two of the eleven fines handed out under the Online Safety Act since March last year. Giving evidence to the Culture, Media and Sport Committee, she conceded nine remain unpaid, four of the offending sites have simply geo-blocked the UK, and three are still up and running with nothing changed.

Via Preston Byrne (Hacker News):

American courts have, by now, provided their preliminary view on the likelihood of Ofcom’s enforcement powers being successful in U.S. courts – the obiter dicta in 4chan v. Ofcom, the opinion in the case we filed against Ofcom in the federal District Court for the District of Columbia a little over a year ago.

[…]

Ofcom can’t enforce the Online Safety Act in America. Ofcom knows it, Ofcom has known it for a long time, and now, Ofcom has, finally, admitted it.

[…]

The GRANITE Act, a foreign censorship shield now before both the House and Senate (H.R. 10174 / S. 5478), is one proposed legal response America could adopt. The HOMEFRONT Act, H.R. 10309, is another. Either of GRANITE or HOMEFRONT would strip sovereign immunity from foreign censors and let Americans targeted by their orders drag those agencies into federal court, where they could be held accountable for their actions.

Previously:

• UK Child Protections and Messaging Backdoor
• Imgur Blocks UK Users Over Age Verification
• UK Online Safety Act
• UK Proposal to Weaken Messaging Security

TheLastProject (Hacker News):

In the [EU age verification] README, the following is listed:

App and device verification based on Google Play Integrity API and Apple App Attestation

I would like to strongly urge to abandon this plan. Requiring a dependency on American tech giants for age verification further deepens the EU’s dependency on America and the USA’s control over the internet.

Bobby Borisov (Hacker News):

The European Union’s open-source age-verification project has drawn criticism after a maintainer confirmed that hardware-bound attestation is a mandatory architectural requirement, raising concerns about Linux, custom Android ROMs, and independently compiled applications.

[…]

The solution lets users prove they are over a certain age without revealing their name, exact birth date, or full identity document. To prevent credentials from being copied, cloned, or reused by modified clients, the project relies on keys stored in protected hardware like Android TEE, StrongBox, or Apple’s Secure Enclave.

However, critics claim that this approach endangers the system by making it dependent on a small number of approved devices, operating systems, and attestation providers.

Positiveblue (Hacker News):

Cloudflare’s new “signed agents” pitch sounds like safety but it’s a wolf in sheep’s clothing. They’ve built an allowlist for the open web and told builders to apply for permission. That’s not how the internet works. An application form is not a standard.

GrapheneOS:

Apple and Google are gradually expanding their use of hardware-based attestation. They’re convincing a growing number of services to adopt it. Google’s Play Integrity API and Apple’s App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.

Google’s Play Integrity API requires hardware attestation for the strong integrity level and is gradually phasing in requiring it for the more commonly used device integrity level. Apple already has it as a requirement. Over the long term, this will increasingly lock out hardware and OS competition.

The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.

German National EUDI Wallet Architecture Documentation (Hacker News):

When issuing the PID, the WB confirms to the PP (via OpenID4VCI Key Attestation) that the keys to which a PID is to be bound are controlled by an authentication means that meets certain security requirements with regard to resistance against attackers with a certain attack potential (see ISO/IEC 18045).

Simon B. Støvring:

It’s great that App Attest is coming to Mac with macOS 27. It means I can ship Canvases’ intelligence and sharing features with much more confidence, knowing I can protect the endpoints with App Attest.

Previously:

• Instagram Charging for Links
• The Age Verification Trap
• Apple Platform Security Guide (January 2026)
• EU Council Approves New “Chat Control” Mandate
• Google Abandons Web Environment Integrity API
• Web Environment Integrity
• App Attest

Toni Sagrista Selles (Hacker News):

In a dramatic turn of events, the Chromium team has reversed its Obsolete tag, and has decided to support the format in Blink (the engine behind Chrome/Chromium/Edge). Given Chrome’s position in the browser market share, I predict the format will become a de factor standard for images in the near future.

[…]

I’ve been following JPEG XL since its experimental support in Blink. What started as a promising feature was quickly axed by the team in a bizarre and ridiculous manner. First, they asked the community for feedback on the format. Then, the community responded very positively. And I don’t only mean a couple of guys in their basement. Meta, Intel, Cloudinary, Adobe, ffmpeg, libvips, Krita, and many more. After that came the infamous comment[…]

[…]

To top it off, a couple of weeks ago, the PDF Association announced their intent to adopt JPEG XL as a preferred image format in their PDF specification.

Michael Larabel (Slashdot):

JPEG-XL image support is back in the very latest Google Chrome/Chromium codebase. Back in December they merged jxl-rs as a pure Rust-based JPEG-XL image decoder from the official libjxl organization. At the end of December they did more JPEG-XL plumbing with the enums and build flags for the support.

Luca Versari et al. (via Jarek Duda):

We’re excited to announce that Chrome is shipping decoding support for the JPEG XL (.jxl) image format starting from Chrome 155. JPEG XL is a next-generation image format designed to meet the needs of modern web developers and photographers. It offers 30-50% better compression than JPEG, lossless compression, built-in HDR support, lossless JPEG transcoding, and more.

In general, we recommend trying both AVIF and JPEG XL to get the best results. We expect that JPEG XL is most helpful for high-fidelity or lossless compression, especially of photographic images or in cases in which fine-grained progressive decoding is preferred.

Previously:

• Chrome Doesn’t Support JPEG XL
• iPhone 16 Adds JPEG XL

Meta:

If you subscribe to a Meta One plan, you can add links to a set number of posts and reels each month based on your plan:

• Meta One Advanced plan: up to 4 posts and 4 reels with links per month
• Meta One Expert plan: up to 8 posts and 8 reels with links per month
• Meta One Max plan: up to 12 posts and 12 reels with links per month

Via Nick Heer:

Instagram has never supported links of any kind in individual posts, so that is a new feature with two links per month permitted for free, and more enabled by this pricey subscription — starting at $50 USD per month for four posts per month containing external links. But links in Reels have been commonplace for years. Meta is now gating that, too; and there is more.

[…]

Meta seems to have two objectives here: to take a cut from businesses that use Meta’s services as a referral source more generally, and — more specifically — to capture some of the money made by influencers.

Requiring login, removing RSS, discouraging links. Things are not looking good for the open Web.

Previously:

• Reddit to Remove RSS
• Twitter Now Requires Logging In
• “Link in Bio” Is Apparently a Billion-Dollar Business
• “Link in Bio” Is a Slow Knife

OpenAI:

Starting today, API customers globally will be able to opt in to text watermarking for select models. Text watermarking will remain off by default in the API.

Over the coming weeks, we will add an invisible watermark to eligible ChatGPT and Codex text output in the European Union.

[…]

More details about how textGrain works can be found in our technical report (opens in a new window), which will be updated with additional details in the coming weeks. We also plan to make the technology available in open source so that others can build on it.

[…]

At a target false positive rate of 1%, our detector identified watermarks in about 80% of 200-token passages, compared with about 95% of 400-token passages, for content such as psychology.

Via John Gruber (Mastodon):

OpenAI has made this available via an API so developers should be able to actually see if this adulterates text output with real-world usage.

Third, none of these companies have yet made their watermark detectors publicly accessible. I remain highly skeptical that they will work as advertised in the real world. I think this is all somewhat of a sham to claim compliance with the EU AI Act without actually providing anything that anyone can actually use in a practical way.

Previously:

• How Claude Marks AI-Generated Content

Jeff Johnson (June):

This new RSS rate limiting was perhaps foreshadowed by an r/modnews post a couple of weeks ago[…]

judy-funnie (September, via Jeff Johnson):

Because RSS is now a common surface for large-scale scraping and automated abuse, we'll stop supporting RSS feeds on November 13, 2026 while preserving moderation workflows that depend on it through supported alternatives.

[…]

To close this gap, in the next few months, we'll further limit access [to Old Reddit] for logged-in users to only those who have used Old Reddit in the last six months (which covers the vast majority of all Old Reddit users).

Ana Maria Constantin:

Public API access ends in March 2027, Reddit said in a separate post for developers. It will stop accepting new API requests on 31 October. From 12 January, it will start cutting off apps that have not registered.

Jeff Johnson:

Since I use RSS to follow Reddit, I intend to discontinue my Reddit use on November 13, unless Reddit backtracks on their user-hostile decision to drop RSS.

[…]

My biggest regret in leaving Reddit is that I‘ll have to shut down my product support subreddit.

[…]

The most ridiculous part of Reddit’s announcement was the suggestion that subreddit moderators replace RSS feeds with Discord notifications. What perversity, insanity to recommend a competing social network as the only practical way to use yours! I’m also skeptical of Reddit’s public excuse for dropping RSS: bot scraping. As I noted back in June, Reddit is already rate-limiting RSS feeds. If the current limits are insufficient, why not impose stricter limits?

John Brayton:

I am disappointed because I know that many Unread customers use Reddit’s RSS feeds to keep up with subreddits.

Sarah Perez:

Moderators have already expressed worry about how this shift would impact their workflow. When Reddit hinted earlier that it was preparing for the end of RSS on its site, many responded by complaining that Reddit would become unmanageable for them. Meanwhile, many users stressed that RSS was how they enjoyed accessing Reddit’s content.

Previously:

• Old Reddit Now Requires Logging In
• Reddit Pushes Web Visitors to App
• Reddit Will Block the Internet Archive
• Reddit AI Training Data and IPO
• Apollo Shutting Down June 30th

Update (2026-10-07): John Brayton:

I overlooked the fact that Feedly uses Reddit’s API to retrieve articles from subreddits. The folks at Feedly expect this functionality to continue working after Reddit removes their feeds.

A Apple bloqueou recentemente oito certificados vulneráveis que eram utilizados pelo Safari para determinar se uma página da web era legítima ou não — recurso que existe para proteger usuários de cópias baratas de sites feitas para golpes.

De acordo com informações do BleepingComputer, essas chaves privadas foram revogadas pela autoridade certificadora indiana eMudhra após pesquisadores descobrirem que eram tão fracas que qualquer pessoa poderia utilizá-las para forjar um certificado de uma página legítima.

Além do Safari, navegadores populares como o Mozilla Firefox e o Google Chrome também se baseavam nesses certificados para proteger usuários. Em um relatório, inclusive, a Mozilla explicou que todos os oito certificados utilizavam chaves privadas P-384 (geradas em abril de 2025), as quais tinham valores menores que 256 — o que permitia a qualquer pessoa recuperá-las testando apenas 256 possibilidades.

Descoberta primeiro por um pesquisador identificado apenas como Wayne, em 17 de outubro, a vulnerabilidade foi demonstrada no GitHub por outro pesquisador chamado Flüpke, o qual mostrou que uma chave privada para o certificado “EM OV TLS CA – G3C” da eMudhra contava com um valor de apenas 4.

Em uma resposta à Mozilla, desenvolvedora do Firefox, a eMudhra disse que identificou um erro em um script usado para gerar certificados que fazia com que um segundo conjunto de chaves mais fracas fosse gerado — as quais eram, então, selecionadas erroneamente como as chaves definitivas por terem rótulos parecidos com os das chaves corretas.

A autoridade também colocou panos quentes na situação ao afirmar que a maioria dos certificados nunca foi usada em produção e que não encontrou evidências de que o problema tenha afetado usuários finais.

Além do Safari, o Firefox e o Chrome também já revogaram esses certificados.

Macs ainda podem estar vulneráveis

Ainda de acordo com o veículo, Dennis Jackson, engenheiro de criptografia da Mozilla, alertou que o utilitário embutido /usr/bin/curl do macOS poderá continuar confiando nesses certificados vulneráveis, pois o seu bundle de certificados não verifica se os certificados foram revogados.

Isso quer dizer que, caso o Mac já tenha aceitado algum desses certificados, ele continuará confiando nele até que haja uma correção — algo que só poderá ser feito em uma futura atualização de segurança.

Após causar um reboliço no setor de publicidade ao quebrar determinados serviços de entrega de anúncios com a versão 27 de seus sistemas operacionais, a Apple finalmente explicou as mudanças que realizou em um post no blog do WebKit.

A empresa afirma estar combatendo um método que ela classificou como “resolução de identidade”, em que empresas de publicidade de terceiros capturam o endereço de email dos usuários em sites quando eles fazem login ou assinam uma newsletter.

Esse endereço pode ser usado para montar um perfil e direcionar anúncios online — uma evolução do rastreamento por cookies, cujo uso por terceiros já é bloqueado pelo Safari há seis anos.

Com o lançamento recente dos novos sistemas, a Apple passou a bloquear, no nível do domínio, as solicitações de rede destinadas à infraestrutura dessas companhias — o que impede o envio do endereço de email dos usuários aos servidores delas.

De acordo com o Business Insider, essa abordagem da Maçã vem agitando o mercado porque pode dificultar bastante o trabalho de anunciantes que dependem desses identificadores para segmentar campanhas e medir resultados.

Com isso, os anunciantes terão menor capacidade de alcançar públicos específicos na web e medir a eficácia de suas campanhas. Em consequência, os anunciantes poderão migrar para plataformas como Google e Meta, que já possuem perfis detalhados de seus usuários.

Embora o Safari conte com um recurso nativo para impedir o rastreamento entre sites, ele ainda pode permitir que rastreadores de terceiros sejam carregados — embora prometa restringir a sua capacidade de efetivamente rastrear os usuários.

Quem quer um bloqueio completo desse tipo de mecanismo deve recorrer a uma alternativa de terceiros, como a Privacy Badger, uma das extensões do gênero mais populares na web atualmente e que acaba de chegar ao navegador da Maçã.

Desenvolvida pela Electronic Frontier Foundation (EFF), a extensão é completamente gratuita e promete bloquear rastreadores de anúncios para impedir que empresas monitorem e efetivamente rastreiem a atividade do usuário entre sites.

No Safari, a Privacy Badger vai além dos recursos de privacidade integrados do navegador para fornecer proteção adicional contra rastreamento online. Em seu modo de navegação padrão, o Safari limita as informações que os rastreadores podem acessar, mas ainda permite que eles carreguem. O Privacy Badger impede que os rastreadores online carreguem em primeiro lugar, impedindo-os de rastrear você usando técnicas que ignoram as proteções do Safari.

Já disponível em navegadores como Google Chrome e Firefox, a extensão funciona de maneira bem inteligente e pode aprender automaticamente a bloquear rastreadores que se escondem na web, tornando a navegação mais privada e segura.

Ele suporta, inclusive, o bloqueio de widgets que podem conter rastreadores — como posts de redes sociais incorporados, seções de comentários e players de vídeo —, substituindo-os por um placeholder com botões que permitem uma ativação manual.

A Privacy Badger está disponível exclusivamente para a versão do Safari para macOS. Nessa página, você encontra os links diretos tanto para a App Store quanto para as lojas de extensões dos outros navegadores compatíveis.

via MacRumors

Cerca de 19 anos após o lançamento do primeiro iPhone, muitos usuários atuais do aparelho da Apple têm curiosidade de saber como era usar o smartphone em seus primórdios — fora aqueles que gostariam apenas de relembrá-lo com nostalgia.

Agora você pode fazer isso (até certo ponto, é claro) diretamente de um navegador, graças a um emulador do iPhone original publicado na web pelo desenvolvedor Kelindi [@_kelindi_], que compartilhou o projeto em seu perfil no X.

WIP: decided to emulate the original iphone in the browser (also works on mobile which is pretty cool)

try it out here: https://t.co/TaPtAYmAwT pic.twitter.com/1xMdAoFDiU

— Kelindi (@_kelindi_) October 13, 2026

Disponível no endereço 2007.mobile — uma referência ao ano em que o primeiro iPhone foi lançado —, ele permite navegar pelos aplicativos e menus tais quais eles estavam dispostos no aparelho original, na época com o sistema iPhone OS.

Com elementos como a Tela Bloqueada, as animações e até o logo de carregamento inicial do iPhone, o emulador mostra algumas particularidades do sistema em seus anos iniciais, como a ausência da App Store e nomes diferentes para alguns aplicativos.

Bem bacana, né?

via OS X Daily

Salvar uma página da web pode ter diversas finalidades — seja para lembrar de algum detalhe textual ou visual, guardar informações de uma certa data ou apenas manter um registro cronológico de algum endereço. Há vezes, porém, que não dá para depender totalmente de bases de arquivos públicos, seja porque o conteúdo pode ter sido alterado ou não é exibido corretamente, entre outros motivos.

Para evitar possíveis problemas do tipo, vale a pena conferir o WebsiteArchiver, um utilitário para macOS que salva e arquiva páginas da web completas, sendo possível separá-las em pastas e categorias. Segundo o desenvolvedor, uma versão para iPhone/iPad será lançada em breve.

Com ele, as páginas da web são salvas localmente como arquivos HTML — com exportação em .html, .warc, .webarchive, .pdf e Markdown — disponíveis permanentemente e independentes de serviços externos.

O app exibe as páginas salvas de três formas diferentes: a opção “Salvo” mostra a cópia offline, enquanto “Leitor” exibe apenas o texto sem distrações e o modo “Ao vivo” mostra a página atual na web. É possível alternar entre eles quando quiser.

Além disso, a captura usa um motor que possibilita que páginas cheias de JavaScript sejam registradas exatamente como aparecem na tela. Também é possível remover imagens inteiras de páginas.

O WebsiteArchiver está disponível gratuitamente na Mac App Store, sendo possível salvar até dez páginas sem custo. Para desbloquear a versão completa, sem limites de registros, é necessário obter a licença vitalícia, disponível por R$120.

Leitores do MacMagazine, porém, podem aproveitar uma oferta especial para adquirir a versão completa diretamente pelo site do WebsiteArchiver: basta digitar MACMAGAZINE30 na área de código promocional para obter 30% de desconto! Saiba, porém, que o cupom é válido somente para os 50 primeiros usos.

A new Nature Astronomy study uses 114 fast radio bursts to trace cosmic gas and test how stellar and black-hole feedback reshapes matter around galaxies.

The post Fast Radio Bursts Are Starting to Map the Universe’s Missing Gas appeared first on Curiosmos.

Com o site do iCloud, os usuários de dispositivos da Apple podem acessar diversos dados da sua Conta Apple (Apple Account), como suas fotos, vídeos e arquivos.

No caso do app Lembretes (Reminders), é possível escolher qual lista será exibida na tela inicial do site — para visualizar aqueles que considera mais importantes sem precisar abrir o web app.

Veja como escolher! 😉

1. Abra o iCloud.com no seu navegador preferido;
2. Localize o quadro do Lembretes;
3. Clique nos três pontinhos;
4. Marque a lista que deseja que seja exibida.

Simples, não?! 😄

Chaque année, votre budget web finance la reconstruction de fonctionnalités via un framework Javascript inutile que votre navigateur web offre déjà grâce aux nouveaux standards web natifs : navigation, formulaires, animations, mises en page. Ce n'est ni un bug ni de l'incompétence, c'est une...

Neil Fraser (via Hacker News):

Nearly twenty-five years ago I registered neil.fraser.name to provide a stable presence on the Internet. It has been the home of this website, my email address, and a server for APIs.

[…]

On 15 April 2026 Verisign proposed the destruction of the entire 3rd level of the ‘.name’ hierarchy in order to simplify their administration. Astonishingly, on 28 July 2026 ICANN approved this action.

[…]

One of my original reasons for choosing ‘.name’ was that it was run by Global Name Registry -- more specifically, it was not run by Verisign. I had history with Verisign and did not trust them. Unfortunately, Verisign acquired Global Name Registry a few years later.

He’s going to lose his site and e-mail address, and someone else could potentially register the domain and hijack his accounts.

Previously:

• .org Top-Level Domain Sold
• The .blog Bait and Switch

Adam Engst:

So I was quite surprised earlier this year when I started to receive personalized pitches from indie developers, a few at first, and now several per week. Many seem to be building apps with AI assistance, but more to the point, they seem to be getting AI help with promoting the apps as well. They often reference our still-current prohibition on press releases with a nominally personal email, but for someone as steeped in words as I am, it’s obvious that an AI is doing the writing.

[…]

At first, this reliance on AI rubbed me the wrong way. But then I realized that it wasn’t really any different than a software company outsourcing its media relations to a PR firm. Those communications had a certain form and set of expectations, and while these new AI-generated messages have a different form, the expectations (coverage) are pretty much the same. AI is simply the new PR agency. Which undoubtedly dismays PR professionals, but there’s still room for those doing PR right.

The problem I have with these new pitches isn’t that the developers used AI to generate them; it’s that they often don’t do it very well.

I’ve noticed a huge increase this year in people pitching me their apps. Many of them seem to have been coded with the assistance of AI. For some app categories, this worries me, and there also seems to be less care taken in following Mac platform conventions. But it’s also exciting to see such a flurry of development, both totally new ideas and fresh takes on old niches. I have a large backlog that I’d like to write about. (There are also many almost indistinguishable variations in certain categories.)

Separately, as Engst says, many of the pitches (and sometimes even the sites) are obviously written by AI. This rubs me the wrong way. I don’t mind at all receiving a generic press release or even a one-liner with a link. But these lengthy e-mails, customized for me, purport to be personal communications when they really aren’t. Sometimes I’ll reply with questions or feedback, and it feels like the entire conversation is with an AI.

When people put in some effort to pitch me their product or article, I’ve always tried to give them a decent reply. Often, I end up learning something or wanting to follow their other work even if I don’t end up writing about what was pitched. This is unfortunately no longer sustainable. There are too many pitches, and it’s demotivating talking to bots. I have to be much more selective about interactions. I appreciate hearing about all the apps, but I’m focusing on the ones that particularly interest me, and I’m less likely to even click the link if it seems like an AI pitch.

Previously:

• Updates to Vibe Coding Apps Rejected From the App Store
• Mac App Store Review Times Increasing
• Bitrig for iOS Early Access

Vlad Fedorov (Hacker News):

On August 17, GitHub experienced an outage that lasted 7 hours and 47 minutes. It disrupted github.com, authentication, GitHub Actions, APIs, pull requests, issues, and Copilot, affecting developers and organizations around the world.

[…]

Neither outage was caused by a code or configuration change. Both incidents were capacity failures at their core. We failed to scale critical components before demand exceeded their capacity. Since April, monthly commits have grown from 1.4 billion to 2.9 billion. That growth explains the pressure on our systems, but it does not excuse these outages.

[…]

As part of the reliability commitments we made earlier this year, we have focused on three priorities: adding capacity, improving efficiency, and removing architectural bottlenecks. We have since added more than 3 million CPU cores, 120 petabytes of high-speed storage, and significant network capacity. We installed as much hardware as available power allowed in our existing data centers while accelerating our migration to Azure.

Alejandro Forero Cuervo:

This is the wrong way to think about this because there’s no such thing as infinite capacity. A large distributed system will be simultaneously mostly idle and (in some subcomponents) overloaded. The root cause is not “a component didn’t have enough capacity (because of auto scaling failures)”, but rather “this complex system collapses (rather than degrade gracefully) when demand exceeds capacity”.

When components reach capacity limits, the excess traffic of the lowest priority should be rejected. Rejected traffic should not be retried — in fact, not only should clients not retry these errors, these errors should cause client-side throttling. Traffic isolation should be applied — if the cause of the overload is a single client/customer system, no other system should be affected.

Nearly a decade ago I wrote about some of the techniques we applied at Google to implement these protections. Most other large internet services have since copied them, afaik.

Previously:

• Mac App Store Review Times Increasing

Richard Speed (Hacker News 3):

XCancel’s home page now contains some minimal text stating: “On Monday 24th August at 8 PM EST, we received at [sic] letter from X Corp. asking to cease and desist the service XCancel.”

It says the service has been halted “until further notice.”

[…]

Nitter provided a way for users to read posts on X without requiring an account. There was no JavaScript or ads, a user’s IP could not be tracked, and it was generally a good deal snappier than the official X client, just read-only. It was the service behind platforms such as XCancel.

The only thing surprising about this is how long it took.

Nick Heer:

Companies like X and Meta are very happy to scrape the web at unprecedented scale and without permission, but have zero tolerance for the same to be done to them by, in effect, individual users. That is not because they are protective of the creative works users have contributed to these platforms. It is simply because users are not trusted to use the platforms. X does not permit third-party readers, and neither does Instagram, because their value does not come from us using these services as we wish, but from how they dictate we must.

Previously:

• Old Reddit Now Requires Logging In
• Reddit Pushes Web Visitors to App
• Instagram Shuts Down Basic Display API
• Twitter for Mac Dead Again
• Social Media AI Training
• Web Scraping for Me, But Not for Thee
• Twitter Now Requires Logging In
• Migrating From Twitter to Mastodon

Update (2026-09-07): There are currently twelve working Nitter instances (Hacker News).

zedeus (Hacker News):

Following legal advice, the Nitter project will continue.

Update (2026-09-16): XCancel (via John Gruber, Hacker News):

Unfortunately, due to a new development in the ongoing legal proceedings, we are required to suspend this service again until further notice. We can’t share more details.

xsukax (via Brent Simmons):

xsukax X RSS Generator fetches publicly accessible X profile HTML, extracts posts and media, stores them locally, and exposes the results as standards-compatible RSS feeds that can be consumed by RSS readers, automation platforms, monitoring systems, and other feed-aware applications.

Após a Apple garantir, ontem, uma suspensão temporária do processo de cálculo de taxas para compras a partir de links externos em sua disputa judicial contra a Epic Games, a Suprema Corte dos Estados Unidos negou o pedido da companhia para estender essa suspensão até a análise de um outro recurso da Maçã relacionado a uma decisão de desacato no caso.

Com isso, conforme divulgado pela Bloomberg, a empresa deverá seguir as determinações da ação que corre na instância inferior referente à taxa que cobra de desenvolvedores por vendas realizadas fora da App Store.

De fato, a Apple apresentou hoje mesmo uma proposta detalhando a comissão que considera razoável cobrar de aplicativos que incluam links para opções de compra fora da App Store — apenas nos EUA. Vale notar que, até agora, a empresa vinha sendo proibida de cobrar qualquer taxa.

Como detalhado pelo MacRumors, a Apple propõe cobrar metade da comissão normalmente aplicada; assim, aplicativos que pagariam uma taxa de 30% por uma compra/assinatura interna serão cobrados 15% ao direcionar o usuário para uma opção de compra na web — a proposta original era de uma taxa de 27%. Já os participantes do programa para pequenas empresas (Small Business Program), que pagariam 15%, serão cobrados 5%.

• Aplicativos padrão: 15%.
• Aplicativos integrantes dos programas de parceria para Notícias, Vídeos e Miniaplicativos, bem como renovações de assinaturas: 10%.
• Aplicativos elegíveis para o programa de pequenas empresas (Small Business Program): 5%.

Essas taxas propostas deverão ser pagas pelos desenvolvedores quando um usuário tocar em um link contido em um app e realizar uma compra pela web. Por exemplo, se um usuário do Spotify clicar em um link no app para acessar o site do serviço e assinar o plano, os serviços de streaming têm de pagar à Apple uma taxa de 15%.

A Epic usou suas redes sociais para comentar a proposta da Apple. Segundo a desenvolvedora, os valores “estão muito além dos limites estabelecidos” e a empresa aponta que apresentará sua contestação dentro de 60 dias.

Apple's filing is in, and Apple admitted that under the Ninth Circuit's definition of "necessary costs" they would charge 0% for purchases made via linkouts to the web.

Apple proposed linkout fees of 15% for standard apps and 5% for Small Business Program apps. Epic believes…

— Epic Games Newsroom (@EpicNewsroom) August 13, 2026

Já a Apple afirma que os valores foram calculados com base em análises de especialistas e são inferiores às taxas de direcionamento externo que o Google está cobrando no seu processo judicial contra a Epic. A Maçã também protocolou uma petição solicitando o encaminhamento para uma conferência de conciliação — a qual poderá ajudar ambas as partes a chegar a um acordo e a restringir ou resolver as questões pendentes.

A Apple enviou a proposta ao Tribunal do Distrito Norte da Califórnia, onde a juíza Yvonne Gonzalez Rogers agora avaliará a proposta e ouvirá a resposta da Epic, de modo que a empresa terá de implementar a taxa definida pelo tribunal.