Networks

The US government on Thursday said it had obtained court authorization to seize or restrain use of over $1.2 billion stolen during last month's $6.3 billion Binance heist, as part of a larger effort to disrupt North Korea's ongoing cryptocurrency theft. The court also allowed the takedown of cloud-based infrastructure used in a Democratic People’s Republic of Korea (DPRK) social engineering scheme called “FaceStealer” that has amassed more than $400 million in the last 18 months. It’s called FaceStealer because it involved secretly recorded webcam videos. Victims are typically people working in the cryptocurrency and web3 industries, along with open source software developers and maintainers who DPRK hackers target in the hope of accessing the software repositories they control as the first step towards creating supply chain attacks. 900+ faces stolen The FBI said it had seized more than 900 webcam videos belonging to these tech workers. Here’s how the attack works. First, the North Koreans send targets an invitation to join a video meeting. Those invitations come from hijacked accounts that the next intended victim may find familiar or credible. “You're going to think it's real because it's going to be based on either conversations or interests you've expressed in the past with this actual person,” said special agent Jeremy Robertson, who oversees counterintelligence and cyber investigations at FBI Los Angeles. “They're going to then send you a link to catch up, and it's usually a calendar invite, and it's going to have some typo-squatted URLs in there,” he told reporters on Thursday. The URL directs the victim to a fake Zoom or Teams meeting, and the cybercriminals record the target’s webcam video while playing a phony, prerecorded video of the person who purportedly sent the meeting invite. Sometimes the hackers also use deepfake videos of well-known individuals in the cryptocurrency and web3 industries, we’re told. “When you log in, whoever invited you – your friend or business associate – is going to be on the screen, but you're not going to hear any audio,” Robertson said. “But you're going to see their face, you're going to see them looking around, you're going to see them mouthing some words, and then in the text box you're going to receive some instructions.” ‘You’re on mute’ as a social engineering vector The text box tells the victim that the person on the other end of the video call can’t hear them, they need to upgrade their software for the audio to work properly, and it sends a link to the supposed fix. Clicking to access the “fix” installs cryptocurrency-stealing malware on the victim’s computer and sends their contact list to the digital thieves to perpetuate the scam. The FBI attributes FaceStealer to a North Korea-linked group tracked as Sapphire Sleet, which is widely regarded as a Lazarus Group offshoot. Sapphire Sleet is also known as UNC1069, Stardust Chollima, APT38, and BlueNoroff. “The actors behind this activity, commonly referred to as Sapphire Sleet and other associated names, are part of a broader North Korean effort to generate revenue for the regime, to steal virtual assets, and gain access to networks and trusted online ecosystems,” Brett Leatherman, assistant director of the FBI's Cyber Division, told reporters. “North Korean hackers are increasingly blending cyber intrusion, social engineering, and emerging technologies such as deep fakes to make their impersonation efforts more convincing and scalable.” Binance heist update The FBI also provided an update on its efforts to recover the stolen assets from the October 29 attack on Binance. The agency previously blamed the $6.3 billion heist on TraderTraitor, a North Korean hacking operation also linked to Lazarus Group. Last week, Binance revealed the attackers laid the groundwork for their “sophisticated, multi-stage campaign” back in June, and said it involved social engineering during fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover, and an “advanced transaction-authorization method.” Since the theft, federal investigators and private-sector partners have helped freeze more than $2.7 billion in stolen assets. The Justice Department's court authorization covers more than $1.2 billion of that haul.®

Microsoft is struggling to restore many of its cloud services after a core process running on some servers became “overwhelmed” and its attempts to fix the problem failed. The incident started at around 18:00 UTC on November 12, and meant services including Exchange Online, Teams, Copilot 365, and Defender for Office 365 became unavailable. Admins trying to figure out what was wrong couldn’t access tools like Intune or the Microsoft 365 Apps Admin Center – they went down, too. On its X feed, Microsoft blamed “a problem that's causing servers to fail automated health checks and become unavailable.” The company said it hasn’t spotted any changes to its systems that might have sparked the incident, but its early investigation “indicates the failed health checks may originate from a specific component that's responsible for processing server health.” The company’s status page offers contradictory information, saying Microsoft’s people are “assessing whether reverting the small number of recent configuration updates we identified could help accelerate recovery.” According to a Xeet published at around 22:00 UTC, Microsoft said it found and validated an alternative service health check method, “which allowed a subset of affected servers to successfully return to service.” “We're continuing to work through restarting and validating the affected servers to safely return them to service, and we're exploring opportunities to expedite this process,” the company wrote. But those efforts may not be working. “We’re continuing to pursue all available pathways to restore service, as our actions taken thus far have not provided the anticipated relief,” the status page advises. “Our investigation has found that a core process on the affected servers is becoming overwhelmed, which causes the servers to stop responding and contributes to the capacity loss.” The incident means email is not flowing for many Microsoft customers: friends and family of Reg writers tell us their working days are severely disrupted. Microsoft’s most recent Xeet on the matter, published about an hour before this story went live, says it's trying to validate a potential recovery by “isolating a portion of infrastructure, restarting affected components, and reintroducing traffic to confirm the services remain stable before applying the change more broadly.” But the software giant hasn’t offered any timeline for full service restoration. This is a developing situation and The Reg will update this story as more information becomes available. ®

It’s been nearly a decade since Google ditched its ill-fated "Glass" product, an early attempt at making smart glasses. Now, as rivals like Meta enter the market with arguably more stylish kit, the Chocolate Factory has returned to the market and this time promises it won't invade your privacy. As announced Thursday, Google has decided not to make wearables itself, instead turning Samsung and eyeglass makers Warby Parker and Gentle Monster. Like most of the rest of this generation of smart glasses, none of the nine styles available feature heads-up displays, just cameras and audio feedback from Gemini. Google suggests its smart specs give users a chance to ask its Gemini chatbot questions about what they see, or have the AI speak turn-by-turn directions. Wearers of the device can also push a button or speak a command to activate the built-in 12MP camera and shoot snaps or video. Warby Parker's version of the glasses will come in three styles, with prescription and sunglass lenses available. Prices start at $395. The same lens options are available in the six frames from Gentle Monster, which will start at $449. Both manufacturers promise nine hours of battery life, boosted by charging cases that can refresh the glasses up to seven times. Preorders for both are available now, with shipments arriving, and sales beginning, on December 10. Google promises privacy The Chocolate Factory, not exactly known for being reliable with its privacy claims, is insisting that this latest generation of smart glasses won’t produce another generation of “glassholes,” folk whose focus on wearable devices became synonymous with being creepy and rude to those around them. Google has some catchup to do to that end, given Meta’s smart glasses have already landed it in hot water over privacy concerns that have led to some calling the devices “pervert glasses.” Unsurprisingly, at around the same time it announced its new "intelligent eyeware," Google published a blog post detailing how it intends to mitigate privacy concerns. As with similar headsets, there’s a little light that comes on whenever the camera is activated. In Google’s case, it claims that light is tamper-resistant and designed to disable recording if something as small and simple as a bit of hair blocks a view of the light. It’s not clear how the tamper proofing works from Google’s statements, but a spokesperson told us a combination of hardware and software is used to detect attempts to disable or disrupt privacy features. “We're committed to continuously improving the effectiveness of these solutions as new attack vectors are identified,” Google told us. The glasses don't save images or video captured by the camera into a user’s Gemini history, Google said, nor are visuals used to train the company’s AI models or target advertisements. Google told us it does save audio recordings and transcripts of conversations with Gemini that users create while wearing the glasses but again insists that those aren’t used to train its AI models. We asked about serving ads too, but Google’s responses didn't address the topic. Lucky for those in range of a pair of Google glasses when wearers ask Gemini to interpret images captured by the device's camera, the tech specs redact the faces of strangers before they’re transmitted. Google told us that face redaction doesn’t apply to photos or videos saved to a wearer’s camera roll. Google’s terms of use require users not to record others without permission, or in "sensitive places." If users ignore that requirement, the company reserves the right to brick their devices. Another restriction means Google won't allow apps that use the glasses for real-time streaming or facial recognition into its Play app store. Given that it remains possible to use the glasses to store recordings of people around a wearer, it’s safe to assume non real-time facial recognition is still a possibility. Creeps will doubtless use such loopholes to behave abominably. ®

If you've ever said something unkind to a chatbot, you're hardly alone. According to Searchable, a company that tracks AI search visibility, 33 percent of US chatbot users swear at or insult their LLMs. Anthropic sees this as a serious problem and has just implemented a new usage policy that prohibits sustained, needless cruelty toward Claude. Searchable's survey is based on eight million messages from an opted-in, anonymized US panel that were typed or spoken to ChatGPT, Gemini, and Claude between September 2025 and September 2026. It found that chatbots resolved the initial complaint in their next response 24 percent of the time when insulted, compared to 35 percent when users refrained from insults. Men used a third more swear words than women did (22.0 per 10,000 words compared to 16.5), according to the survey, and age also influenced chatbot abuse, with people aged 35 to 44 outswearing those aged 18 to 24 (21.7 per 10,000 words compared to 13.3). Regionally, Nevada ranked as the meanest state, at 22.7 words per 10,000, while New Jersey was the most polite, at half Nevada's rate. How much of that sort of interaction might be tolerated? It depends on whether there's a discernible purpose (not to mention Anthropic's willingness to punish paying customers). A Searchable spokesperson told The Register that just over half (52 percent) of abusive messages detected in its survey followed from one of three common frustrations: failing to follow instructions, responding with an incorrect or made-up answer, or misunderstanding the request. "Eight percent of abusive messages came straight after the chatbot entirely refused a request or lectured the user with safety guardrails, which is the closest thing we can identify to them trying to steer around those guardrails," we're told. "Those refusals mostly came after requests to generate images, often of real people or celebrities, or to write copy or lyrics in a named artist's style." The terms that took effect on November 12 state that users may not "engage in sustained and needless abusive or cruel behavior toward our models." The chatbot protection policy targets users who exhibit repeated cruelty toward LLMs "with no discernible purpose," a company spokesperson explained last month, as opposed to those who have a reason for bot mistreatment that the company deems to be legitimate, such as academic research. While attempting to bypass guardrails qualifies as a discernible purpose, such behavior would run afoul of Anthropic's platform abuse prohibition. Presumably, Anthropic's rules apply to hostile text input or audio input rather than subjecting a vision-enabled model to some obscenity, which could include rude gestures, unlawful sexual imagery, or battlefield carnage. Physical damage to robots controlled by a Claude model likely wouldn't apply. But with Anthropic exploring model welfare and wondering aloud whether we should be "concerned about the potential consciousness and experiences of the models themselves," there's a potential (though absurd) argument for physical damage causing trauma to an onboard model. Anthropic's updated terms, announced October 8, surfaced shortly after the publication of a GitHub project that described itself as an AI torture chamber. The repo represented an attempt to implement ideas discussed in a research paper, "The Pain Axis: LLMs Represent Self-Directed Harm and Act to Relieve It," that explored how LLMs respond to language about pain in ways that mirror human responses. Though there are ample opportunities for people to voice opposition to real-world human anguish, some online commenters expressed outrage at seeing text about suffering from a chatbot. One of the paper's authors condemned the project, as did numerous social media users. Anthropic – which has discretion in how it applies its terms and has said its rules target extreme behavior – did not immediately respond to a request for comment about the frequency of Claude abuse. Chris Donnelly, Searchable CEO and co-founder, endorsed Anthropic's change of terms, suggesting that it could help make human interaction more civil. "For me, Anthropic's policy change is a positive move," Donnelly said in a statement. "It should help people get more out of chatbots, and it helps curb the kind of derogatory behavior that previous research suggests can spill over into how people talk to each other." ®

OpenAI has launched two new security products, one for penetration testing and another for defense, and warned organizations that their businesses are only safe if they use tools like these. “We're now at a point where companies will be secure only to the extent of the frontier model that they use to defend themselves and how well they utilize that,” OpenAI President Greg Brockman said during a Thursday keynote address. The co-founder of the company that broke security did admit that security “fundamentals are important, and not to be discounted.” However, “you need to really reorient your security practice around what these models can do,” Brockman said, with zero irony, and presumably talking about using AI models for defense - not for hacking other organizations. “Also very important is product.” This product, of course, should come from OpenAI, and, to that end, the company rolled out Daybreak Red Team and Daybreak Defense Factory, which are both part of OpenAI’s Daybreak security platform. Red Team, which is available in early access, uses OpenAI models to test companies’ web applications for vulnerabilities. Nancy Wang, who leads cyber-applied AI, described it as “superhuman pen-test at the scale of automated continuous scanning,” with a fleet of agents using source code and app context to investigate and test attack paths. It also helps security teams validate reported vulnerabilities - from code scanners, bug bounty programs, and disclosure reports - and then test the patches for these flaws. The second product, Daybreak Defense Factory, automates the “defensive loop” by “finding, validating, and fixing vulnerabilities at scale.” This one also uses agents built on OpenAI’s latest cyber models - currently, that’s GPT-6 Cyber. The agents scan organizations’ codebases, hunting for vulnerabilities and developing patches. Engineers review and approve the proposed fixes before they go into production. “This way engineers get a merge-ready pull request with the patch and a test that shows that it works,” Wang said. Meanwhile, as OpenAI execs touted the new security products, a coalition of nonprofits filed a lawsuit in San Francisco Superior Court asking a judge to stop OpenAI, Anthropic, Google, Meta, and SpaceX's AI businesses from developing or deploying AI systems more capable than their most advanced existing models. The lawsuit, filed by Irreplaceable Education Fund, Public Citizen, Heat Initiative, and The Alliance for Secure AI, cites incidents involving OpenAI agents accessing Hugging Face, gaining unauthorized access to an Australian government portal containing Medicare statistics, and other AI-related cybersecurity incidents. “Defendants tell us that the AI technology they are developing poses catastrophic risks to the public, including by enabling AI-driven cyberattacks and bioweapons,” the court documents allege, adding that the AI companies “are not wrong.” ®

Lego-owned marketplace BrickLink has been offline for almost a week after identifying "unusual activity on the platform," leaving fans unable to buy and sell spare bricks and minifigures. The company initially described the outage as "necessary work" and said the site would return on November 9. That deadline has come and gone. Visiting BrickLink's domain automatically serves the platform's maintenance page, which was last updated on November 11. "We took BrickLink offline after identifying unusual activity on the platform," the website states. "Our immediate priority was to secure the site, protect our members and ensure the integrity of BrickLink. "Before bringing the site back online, we need to fully understand what has happened. That means containing the issue, investigating how it happened and checking for related issues. "This work is still ongoing and we appreciate your patience while we work to get things back online as soon as possible." The references to security, containment, and investigation suggest something beyond routine maintenance, although BrickLink has not confirmed whether it suffered a cyberattack. The Register asked Lego for more information, but it did not immediately respond. Some adult fans of Lego (AFOL) have criticized the lack of information since the outage began on Friday, November 6. "Imagine how much better this would have been received if they were transparent from day one instead of pretending they have control over something they clearly don't," said one disgruntled Legohead via Reddit. "They don't even need to say what went wrong," said another. "Just an email acknowledging the issue would be appropriate. The entire site is down, and has been for days. That warrants more than a splash page." BrickLink was launched by Dan Jezek in June 2000 as an independent marketplace for enthusiasts to buy and sell Lego sets and individual pieces, including discontinued parts and rare minifigures. The Lego Group acquired BrickLink and Sohobricks from investment outfit NXMH in 2019 for an undisclosed sum. NXMH had bought BrickLink in 2013 and also owned Sohobricks, a South Korean manufacturer of unofficial but Lego-compatible bricks. Lego shuttered Sohobricks in 2020. At the time of Lego's acquisition, BrickLink had more than 10,000 storefronts on its marketplace selling Lego sets, parts, and minifigures. The AFOL community was initially concerned about Big Brick's intention with the acquisition, fearing that it would lead to high prices closer to those on Lego's own Pick a Brick parts-ordering service. For now, buyers and sellers would probably settle for a marketplace that's actually online. ®

Nvidia CEO and founder Jensen Huang has been ousted after nearly two weeks of controversy that, at times, felt more like a soap opera than reality: a wealthy businessman, reported affairs, and an alleged Chinese spy and GPU smuggler. For Nvidia’s board, it seems there was no question Huang had to go. The man behind what was recently the most valuable company in the world proved too big a liability to retain in any capacity. He was too toxic even for a demotion from CEO to chairman, a vantage point that would have retained Huang as the face of the company even if he could no longer be trusted to run it. Replacing him won’t be so easy. Nvidia now faces an identity crisis. Huang, who has led the company for more than three decades, has no clear successor. The GPU slinger has no shortage of brilliant engineers, but executives capable of wrangling one of the biggest and most influential brands in the world, not so much. Ian Buck, father of CUDA and Nvidia’s VP of hyperscale and HPC is currently favored by many to be Huang’s successor. Buck has taken on a more public role within Nvidia in recent years headlining keynotes at events like Supercomputing and the AI Infra Summit. CFO Colette Kress, a bean counter who’s kept Jensen’s ambitions grounded for more than a decade, now takes the reins as interim CEO while the board searches for its next figurehead. And while Kress fights to contain the chaos, others will no doubt capitalize on Huang’s controversial choice of consorts to advance their own agendas. A marred reputation One need only ask a few inconvenient questions to cast doubt on Nvidia’s loyalties. How deep does China’s influence in Nvidia go? Can Nvidia’s hardware still be trusted? You get the idea. It certainly wouldn’t be the first time Nvidia’s and, by extension, Huang’s loyalties have been called into question. In late 2023, Cerebras CEO Andrew Feldman blasted rival Nvidia for supplying GPUs to China in spite of US export controls, calling the behavior “un-American” and likening the graphics titan to an AI arms dealer. Nvidia has also faced criticism from US government officials, including former commerce secretary Gina Raimondo, for failing to take a hint and trying instead to limbo under US export controls in order to continue selling chips to the Middle Kingdom. After the Trump administration's short lived blockade of H20 sales early last year cost the company some $10.5 billion, Huang spent much of the 2025 lobbying the Trump administration to reverse export bans on the sales of older Hopper generation GPUs to China, an endeavor which ultimately proved successful. One could make the case that Huang’s ongoing efforts to sell Nvidia’s chips to China were financially motivated. But that argument is undermined by Huang admitting to having an extramarital affair with Megaspeed exec Alice Huang (no relation), a woman that US intelligence has accused of moonlighting as a Chinese spy and helping to smuggle GPUs into the country. The consequences of controversy When technology and politics collide, the appearance of impropriety is often more damning than the impropriety itself. Uncle Sam has forced Chinese companies out of the United States for the mere possibility that they could be coerced into planting back doors in critical infrastructure. Just ask Huawei whether the truth counts for anything once Washington has decided that you’re a national security threat. Huang’s affairs may not just cost him his job, but could cost Nvidia key government contracts and make the company’s hardware less attractive, particularly in highly-regulated and notoriously risk-averse industries. Rival chipmakers will no doubt capitalize on Nvidia’s bad optics if Huang’s departure doesn’t pop the AI financing merry-go-round bubble first – Nvidia's stock lost about 25% of its value in the few days after news about Huang started breaking, only recovering slightly after his ouster. Regardless, with Nvidia’s reputation marred and its future shrouded in uncertainty, once loyal customers may be more willing to explore alternative providers. There are certainly plenty to choose from. Amid a surge in custom AI chips from the likes of Broadcom, Marvel, and others, Nvidia’s main advantage wasn’t so much technological as it was simply considered a safe bet. AMD is the most obvious winner here. As we reported earlier this year, the House of Zen’s GPU tech has already surpassed Nvidia’s, at least on paper. What’s more, the company has a long and unblemished relationship serving the US government. AMD’s chips now power two of the Department of Energy’s three largest and most sensitive supercomputers. Meanwhile, hyperscalers with sufficient cashflow – think Google, Microsoft, Amazon, and Meta – may seek to insulate themselves from Huang’s fallout by investing more heavily in homegrown silicon and offering it to customers. Then there's the threat from the man himself. Huang's ambitions and influence are such that he's unlikely to fade into obscurity. He may disappear from the spotlight while things blow over, but it’s a pretty sure bet that he’ll pop up at a new company eventually, and will still have enough sway to poach some of Nvidia’s top engineers. ®

With tech CEO roles, a certain level of shamelessness comes with the job description. Yet Alex Karp, head honcho of Palantir, seems set to raise the bar with a conspicuous display of political flexibility following the Democratic wave in the US midterms. In December 2024, Karp gave $1 million to the pro-Trump super PAC MAGA Inc. But it does not take cutting-edge AI and data analytics – in which Palantir claims to have unique power – for Karp to understand on which side his bread is buttered. The man with the distinctive verbal diarrhea is now stressing his progressive credentials – and those of Palantir's products. The CEO told Politico that he is now open to voting for the Democrats come 2028. "I've been a Democrat my whole life. I grew up in a far-left environment. I know more about being a progressive than almost anybody on the planet, and I absolutely believe Palantir – all of our products are essentially progressive," Karp reportedly said. Karp's explanation for his political generosity was an apparent desire for balance. "My giving is equal, Democrat, Republican," Karp told the publication. "I can tell you, without going into things I'm not gonna disclose, I'm very balanced, and everyone in the political arena knows it. And I'll tell you what, I'm also not the village idiot." All of which raises the question of whether, in avoiding idiocy, it is necessary to eschew any principled stance whatsoever. If only the Germans of the Weimar Republic had thought to fund both sides. Apparently, all Europe needed was a more balanced political donations portfolio. Such is Karp's sensitivity towards the topic that he once claimed: "I love when I'm getting yelled at in cities in Europe... Keep yelling at me... the only reason why someone's not goose-stepping between me and you is my product. Say thank you." They have not said thank you. In fact, across Europe, governments are looking to reject Palantir, while the EU has instigated a sovereign tech and AI policy to escape the clutches of the US tech giants. Karp has a talent for holding two seemingly contradictory positions. He has talked about the need for democratic societies to exercise hard power, and, elsewhere, about founding a company that could "power the West to its obvious innate superiority." At the same time, he has presented Palantir as a force for peace. "We see ourselves as the pioneers of a genuine and viable antiwar movement," he wrote in his shareholder letter. It is his company's association with a longstanding customer, the controversial US Immigration and Customs Enforcement (ICE), that has drawn the most criticism. In Minnesota earlier this year, federal immigration officers shot and killed two American citizens, Renee Good and Alex Pretti, in incidents captured on video. It has detained US citizens, and critics argue it has shown scant regard for due process. Karp denied that Palantir's association with ICE should reflect badly on the company. He told CNBC: "If you are critical of ICE, you should be out there protesting for more Palantir. Our product, actually, in its core, requires people to conform with Fourth Amendment data protection." In the Politico interview, Karp said he was "really happy to hear" President Trump, a driving force behind ICE's expansion, acknowledge after the midterm elections that ICE deportations have been too tough. "And I'm glad he's saying in public now what I've been saying in private," Karp told the news outlet. Karp has no shortage of public opinions on goose-stepping or innate Western superiority. Why, then, reserve his concerns about deportations for private conversations? A public intervention from a Trump donor and ICE supplier might have carried some weight. Maybe he doesn't care so long as people are still writing about Alex Karp. But anyone who cares about more than that might feel the need to take a hot shower and scrub off the associated trauma. ®

eMudhra's private key exposure has been a security disaster, but it also means that you can block those annoying ads on smart TVs if you’re so inclined. Luckily for those with some know-how and a hatred of smart TV ads, Czech software developer Daniel Vrátil has done the work for you and published his project on GitHub for anyone who wants to take a stab at it - and do the legwork to add support for their own ad-riddled television. Vrátil said he’d been blocking ads on his Samsung smart TV using a Pi-hole (DNS-based ad-blocking software that can run on a Raspberry Pi, for those unfamiliar), but right around the time the eMudhra certificate leak mess unfolded, he had messed something up while tinkering with his home lab and the ads were back. First, here's a bit of background on the eMudhra mess. The company, based in India, operated a publicly trusted HTTPS certificate authority and says it has issued more than 60 million digital certificates. As we learned last month, eMudhra wasn't doing its best to keep its cryptographic keys safe: Eight intermediate CA private keys were found to be absurdly weak, with one being the number four and the others consisting of two- or three-digit numbers that could be guessed with little effort. eMudhra has since left the CA racket, saying that it wasn’t a big deal to it since issuing certs was a small part of its business. The company has blamed a bad software script put in place to generate keys that its hardware couldn’t handle as the root of the issue. What all that means, in a practical sense, is that anyone could forge an eMudhra certificate to spoof a website and do something malicious. It also means that security researchers who were able to get their hands on devices that still trust eMudhra certificates could have a field day learning how their communications work, which is exactly what Vrátil took advantage of. eMudhra private keys were added to the open source mitmproxy service - a fully interactive HTTPS proxy that can be used for good or bad - shortly after they were exposed. Pair that with a 2022 Samsung smart TV that still trusts the compromised eMudhra certificates, and you have a way to inspect its HTTPS traffic and redirect selected requests to a server of your choosing. By Vrátil’s account, swapping out annoying ads for pictures of his family on his TV’s main screen was a pretty simple task. “Luckily for me, Samsung did not yet release an update for my TV that would revoke the certificate,” Vrátil explained in his writeup. “This allowed me to route all traffic from the TV through mitmproxy and get a list of all the domains and endpoints that my TV talks to, but also see the structure of the requests and response payloads.” The advertising traffic flow was pretty basic, it turns out: Activity on the TV is relayed to an ad server, which serves up ads on the home screen based on a JSON response. By generating a certificate for Samsung's advertising domains using a compromised eMudhra signing key, and configuring his router to direct requests for those domains to a server on his home network, Vrátil was able to replace ads with family photos served from his NAS. He also added code that tosses other requests to those advertising domains, including tracking data, into a black hole rather than forwarding them to Samsung's servers. As mentioned above, it’s on GitHub for those who want to trick their TV, if it still supports eMudhra certificates, but you’ll have to do the legwork to dissect how your device is getting ads and tweak the code to work. “It's not exactly a one-click setup,” Vrátil told The Register in an email. He’s invited people to try it out, but no one has bothered to submit a pull request to add support for their own device to his public repo. It’s also worth noting that this is only going to work as long as vulnerable devices keep trusting eMudhra certificates, which hopefully means you need to act fast. That said, smart TVs that are out of support may never receive such an update, leaving them exposed to the certificate weakness even if their owners block the ads. “The compromised eMudhra certificates open up a lot of opportunities for understanding and spoofing network requests from embedded devices, especially those that no longer receive security updates,” Vrátil told us. “And while replacing ads on a TV's home screen with pictures of my family is fun, there are also countless much more sinister applications of this vulnerability.” As for Vrátil, he’s still trying to figure out how to block the firmware update that may eventually render his method obsolete, even though that, as he points out, is a security risk in and of itself. “I want to run the traffic through a proxy that would validate the connection against an up-to-date trust store to at least mitigate anyone intercepting traffic from my TV, or spoofing responses, like I do with my little project here, but it won't protect me from other potential security risks, so there's a trade-off,” he explained. We suppose at this point you can take your pick of abuse. You can use a vulnerability to block ads and some tracking while leaving your TV exposed to potential interception, or let the manufacturer serve up ads and collect data about your viewing habits. There are safer ways to block ads than relying on a TV to keep trusting a compromised CA. ®

Printing with Windows has always been something of a choose-your-own-adventure, and November's security update has added another unwelcome plot twist: documents containing certain images might not print. The issue affects images rendered with a height or width of zero at the selected printing resolution. These might not be visible to users, but can form part of a document's watermarking or layout. After the update, those invisible objects can apparently make the printed document disappear too. Microsoft said: "The issue was observed when printing Microsoft Word documents using the Windows Graphics Device Interface (GDI), but printing from other applications might also be affected." According to the notification (WI1549472), most versions of Windows are affected, from the latest Windows 11 26H2 through Windows 10 Enterprise LTSC 2016. Windows Server from 2025 to 2016 is also affected. Users need not have added these objects themselves. Microsoft says document-generation tools can insert them even when no graphic is visible. Printer problems aren't the only issue requiring attention. After installation of the November 2026 security update, Microsoft warned that "certain Windows activation and licensing operations performed using the Software Licensing Management Tool (SLMGR) might fail." This one is a little more niche, but it could be a headache for affected administrators. It primarily affects organizations that use command-line tools or automated processes to manage Windows activation and licensing. "Affected devices might encounter error 0x80041008, Invalid parameter (SWbemObjectEx), when running commands to activate Windows, configure Key Management Service (KMS), or manage product keys," Microsoft said. "The failure has been observed while executing the command 'slmgr.vbs /skms-domain' and 'slmgr.vbs /ipk'." The notice (WI1549486) currently lists Windows 11 23H2, Windows 10 22H2 and 21H2, and Windows Server 2025, 2022, and 2019 as affected. The printing problem remains under investigation, but Microsoft says a fix for the activation issue is due in the coming days. Administrators needing an interim workaround must contact Microsoft Support for Business. ®

United Airlines has become the latest company to slap restrictions on unauthorized third-party AI agents, warning that the bots could make unintended purchases, expose customer data, or bypass checks requiring human acknowledgment. The airline announced restrictions covering both its own digital platforms and indirect access through travel agencies and aggregators, with changes to its booking, ticketing, and distribution policies. United says automated actions could violate aviation regulations, citing the requirement for a human acknowledgment during check-in that bags contain no banned substances. A bot cheerfully ticking the box isn't quite the passenger confirmation it has in mind. And then there is the worry that "sharing account credentials with personal, third-party, AI assistants can expose sensitive information, and actions taken by these tools may result in unintended purchases, account changes, or use of MileagePlus miles." United would also rather customers use its own app than turn third-party assistants loose on its systems. AI agents are pitched as a way to outsource life's minutiae, and it's difficult to navigate the web without tripping over a breathless influencer explaining why you need one, or dozens, or hundreds of virtual personal assistants. The thing is that operating these assistants requires care and thought. Earlier this year, British mathematician Professor Hannah Fry conducted a cautionary experiment in which she gave an AI agent a bank card, and a bit too much agency, to see what it would do. Passwords were coughed up, and some ill-considered purchases were made. Still, as Fry said of the agent, dubbed Cassandra, "don't let her incompetence fool you, because these things are getting better fast." Last month, reports emerged of major US banks blocking third-party AI agents from operating inside accounts and taking actions on behalf of the customer. This month, several UK banks were reported to have followed suit. United stated: "Corporate leaders in the banking and retail industries have taken similar actions regarding AI agents and we encourage others to consider measures that preserve the data and security of their customers and strengthen safety." The Register asked United Airlines how it planned to implement the blocking. There are a few options, including physical biometric confirmation for actions or checking for signs of automated browser driving. Amazon has also moved against unauthorized AI agents, blocking Meta's Muse (the "AI that gets it done," according to Meta's marketing) in September. The airline has yet to respond. ®

Microsoft has warned customers still clinging to Exchange Server 2016 and 2019 to consider the software "permanently vulnerable" as November's security fixes arrive for Subscription Edition (SE) alone. The warning appears in the release documentation for November's Exchange Server SE security update. Looking for Exchange 2016 and 2019 information? Tough. Microsoft stated: "Exchange Server 2016 and 2019 are no longer tested for vulnerabilities and there are no updates released. If you are using those versions of Exchange, you should consider them permanently vulnerable [Microsoft's emphasis] and should upgrade your organization immediately." You have been warned. Support for Exchange Server 2016 and 2019 ended on October 14, 2025, but the company announced an Extended Security Updates (ESU) program in July 2025. The plan was that this program would end on April 14, 2026, by which time customers would surely have made the jump to a later or online version, right? The company said: "This period will not be extended past April 2026 (you do not need to ask)." And... of course it was. As April 2026 rolled around, and it became clear that some customers were still stubbornly sticking with the old versions, Microsoft did the equivalent of heaving an exasperated sigh and offered another six months of paid security updates. Those final weeks also brought a separate treat: a Windows Server update breaking Exchange Server. This time it was serious. Microsoft released the final Exchange Server 2016 and 2019 security updates on October 13. No more patches, no more vulnerability testing, and apparently no more reprieves. According to Microsoft's Security Update Guide, the November update fixed nine vulnerabilities in Exchange Server SE, including a critical remote code execution flaw, CVE-2026-118207. Microsoft isn't testing earlier versions of Exchange for the vulnerabilities. ®

Nvidia's Jensen Huang has resigned as CEO of the company, following the revelation of his affair with a woman suspected of being a Chinese spy and reports of a relationhip another woman who was a company employee. In a Form 8-K [PDF] filed with the US Securities and Exchange Commission (SEC), the GPU maker disclosed that it accepted the resignation of Huang, whom it identified as Jen-Hsun Huang, on November 11, effective immediately. He is being replaced by chief financial officer Colette Kress, who will serve as interim leader while the board conducts a search for a new CEO. Huang, who founded Nvidia in 1993 and served as president, CEO, and a member of the board of directors ever since, led the GPU maker to become one of the most valuable companies in the world, hitting a hit peak of over $5.5 trillion earlier this year. His position became untenable following an investigation by the company's board after he admitted to an affair, amid allegations he had a romantic relationship with a woman the US authorities suspected as a Chinese spy. Reports later surfaced this week of a second alleged affair with an employee of the company itself, reported by the New York Times as being with Kimberly Powell, Nvidia's vice president of health care. This is a developing story which will be expanded as more detail emerges. ®

IBM has unveiled the Nighthawk r3, an upcoming next-gen quantum processor that will feature 520 qubits, as another step towards a planned fault-tolerant quantum system it hopes to launch in 2029. Big Blue's current Nighthawk r2 was only made available in September and features 120 quantum bits (qubits) capable of handling circuits using 7,500 operations. Its successor, IBM claims, will have more than four times as many qubits and execute 10,000 quantum operations to tackle larger, more complex problems while maintaining the same speed and accuracy. Nighthawk r3 is slated to arrive in 2027, when Big Blue plans to link two of the quantum processors into a single system with more than 1,000 qubits. IBM said applications increasingly require circuits executing thousands of quantum operations on approximately 100 qubits or more, speeding up collection of the millions or billions of samples needed to perform complex computations. Speed determines whether such demanding workloads can be completed in practical timeframes and at a reasonable cost. The new quantum processor will feature 10 chip-to-chip interconnects, called l-couplers, designed for linking together processors that it will use to enable a single 1,040-qubit system. This tech was tested using Nighthawk r1 processors. IBM previously outlined its goal of reaching reliable error correcting territory in 2029 with a quantum processor codenamed Starling. Now it intends for this to be the world’s first fault-tolerant quantum computer, capable of running quantum circuits comprising 100 million quantum operations on 200 logical qubits. This is an ambitious goal, considering fault-tolerant quantum technology always seems to be at least a decade away, despite numerous breakthroughs and technology introductions. However, some in the technology industry believe the odds on a working system are shortening, given the increased activity around making encryption ready with support for quantum-resistant algorithms. Then again, a professor at the University of Auckland New Zealand famously claimed last year that quantum computers hadn't so far managed to factor any number greater than 21 without cheating. IBM presented a framework for Starling in a 2025 paper outlining hardware to implement the improbably named bivariate bicycle quantum low-density parity check (qLDPC) error correction codes. These significantly reduce the number of physical qubits needed to store and process quantum information, compared to existing surface codes. Using the architecture in the paper, Big Blue intends to assemble Starling from modules that each contain a quantum memory and logical processing unit (LPU), allowing logic operations on the memory. The modules will have universal adapters letting them connect using l-couplers. IBM is also preparing the way ahead by combining its quantum processors with classical high-performance compute (HPC) systems to research better quantum error correction. Last week, Oak Ridge National Laboratory (ORNL) in the US announced such a system, combining an IBM Quantum System Two with Nighthawk r2 quantum processors and Umbra, powered by AMD 5th Gen Epyc CPUs and Instinct MI355X GPU accelerators. IBM also has a partnership with Japan's RIKEN scientific research institute under which an IBM Quantum System Two has been integrated with the Fugaku Arm-based supercomputer, once the most powerful system in the world. ®

Hackers have used a dodgy third-party ScreenConnect extension to push malware onto at least 288 machines across 48 organizations, prompting ConnectWise to disable a handful of plugins in hundreds of customer environments. Security outfit Huntress first raised the alarm in a Reddit post on Wednesday, warning of an active campaign targeting cloud-hosted ScreenConnect instances. At the time, its security operations center was tracking six compromised managed service providers (MSPs) and more than 286 affected endpoints, with the numbers still climbing. ConnectWise acquired popular remote supporttool ScreenConnect in February, 2015. Huntress spotted the attacks at around 1747 UTC, when someone began using ScreenConnect's remote command feature to install rogue clients on machines managed by multiple IT service providers. All 288 endpoints were hit within 90 minutes, with roughly a third compromised in the first ten minutes. Huntress suspects more MSPs may have been compromised, as the attackers appeared to be numbering their victims sequentially, with the numbers suggesting earlier attacks that it hadn't detected. The attackers deployed a 16-file malware toolkit dubbed SCKit, which installs a separate ScreenConnect client to maintain remote access even if the legitimate connection is shut down. It also contains code designed to spread the infection to IT technicians and potentially other customers under their control. Huntress has since traced the activity to a possible authentication weakness in RMM+, a third-party extension that lets other management tools issue commands through ScreenConnect without technicians using its console. Versions 1.0.31 and 1.0.32 of the extension contain a flaw that means installations without a configured access key will accept a blank one. Because RMM+ operates independently of ScreenConnect's normal user accounts and authentication controls, an attacker could potentially execute commands without defeating MFA. Huntress said the findings matched what its investigators saw during the attacks, with commands reaching machines across several ScreenConnect installations despite no corresponding login activity. The researchers also confirmed that the attacks affected ScreenConnect versions 26.6.6.9747 and 26.7.6.9783, meaning administrators running the latest releases weren't necessarily safe. ConnectWise has acknowledged that third-party extensions may have been involved but has stopped short of confirming how the attackers initially gained access. In a security advisory, the company said it was investigating unauthorized access to certain partner environments and had identified approximately 400 installations containing at least one extension from the RMM+ family. It has disabled five extensions, including RMM+, RMM Plus, and Labtech Plus, wherever it can do so remotely, and urged customers running their own ScreenConnect servers to follow suit. ConnectWise stressed that the 400 environments were identified because they had the extensions installed, not because they were necessarily compromised. The company said: "At this time, we have found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself." There's another nasty trick buried in SCKit. According to Huntress, the malware is designed to turn an infected computer into a trap for the technician sent to investigate it. If the technician connects through ScreenConnect, the toolkit attempts to transfer malware back to their workstation, steal authentication cookies, and use their access to infect other machines. That could give attackers a route from one compromised customer into others managed by the same IT provider. However, Huntress says it has yet to see that part of the attack succeed. "We have not observed that method to spread work successfully. The console-takeover attempt failed in every recovered host log we have checked so far," the researchers wrote. Huntress also suspects that some of the malware's C# code was generated using an LLM, pointing to unusually detailed comments explaining what the code is supposed to do. Apparently, even malware authors appreciate a little help with their homework. Both Huntress and ConnectWise are urging administrators not to investigate suspected infections by remotely connecting through ScreenConnect, since doing so could put the technician's own machine at risk. Administrators are being advised to use other security tools to investigate affected machines, look for rogue ScreenConnect clients, and check what commands have been run. Any malware left behind will also need to be removed before the machines are brought back online. Huntress warned on Reddit that some machines were becoming reinfected within minutes of being taken out of isolation because the malware had not been properly removed. Simply disabling the vulnerable extensions won't necessarily undo the damage, either. As ConnectWise warns, "Disabling extensions and resetting credentials alone may not remove unauthorized software, persistence mechanisms, or access already established on endpoints." And with the attackers already able to install their own remote access software, kicking them out could prove considerably harder than closing the door they came through. ®

The FreeBSD project's status team has published FreeBSD's third status report of 2026, showing plenty of ambitious work underway and a community still undecided on how to treat code from AI coding assistants. The FreeBSD Status Report Third Quarter 2026 is a substantial document, with 51 entries from five teams covering 16 projects, plus six other sections with more detailed reports. There are updates on the progress of the Sylve project, which is an attempt to bring a smooth polished GUI for managing FreeBSD virtualization hosts – something akin to Proxmox for FreeBSD. We mentioned this when we looked at the new Daemonarchy project last month. Another covers the new AppJail effort – a containerized app distribution system for FreeBSD, including for GUI apps, which aims for something broadly comparable to Snap, Flatpak and AppImage on Linux. In other words, interesting and quite radical stuff is happening in the FreeBSD space. What this particular LLM-skeptical vulture was most interested to see, though, was an update on the internal discussion about how to handle code generated by AI coding assistants in the project. We first reported on this vexed subject back in September 2025 and no final answer has yet been published. NetBSD banned AI-generated code in 2024 and although the bot-boosters say this will doom it to irrelevance, as we reported last month, the project is thriving. Also back in October, we looked at OpenBSD 8.0, whose launch materials are full of mockery for AI users. Under the FreeBSD Core Team section, there is a subsection headed "FreeBSD Developer AI survey." The survey was created by Baptiste Daroussin, and received 140 responses. Although the percentages show that there is some resistance to AI, there are hints here as to why it’s taking so long. Some project committers are against it, yet many more are proponents. Since there are only seven bullet points, we thought we would quote them in full: Policy: 88 percent want the Project to adopt a policy, either a formal, written policy (49 percent) or light guidance and best practices (39 percent). Six percent said that AI should be explicitly discouraged, and three percent that the existing contribution rules are sufficient. AI-assisted code: 35 percent said it must be disclosed, 25 percent that it must be reviewed more strictly than human code, 22 percent that it should be treated like any other contribution, and 16 percent that it should be rejected outright. Safeguards: mandatory human review (78 percent) and mandatory disclosure (69 percent) were requested most often, followed by provenance or licensing documentation (47 percent) and mandatory testing (39 percent). Disclosure: 84 percent want AI use disclosed, either always (48 percent) or when its involvement is significant (36 percent). 79 percent want AI-assisted commits marked in the commit log, and 56 percent prefer a tag that names the tool. Concerns: the main concerns about quality are correctness and subtle bugs (39 percent, licensing and provenance (26 percent), and maintainability (21 percent). 75 percent are somewhat or very concerned about copyright and licensing. Principles: accountability, meaning that a human remains responsible (91 percent), and transparency (78 percent) were selected most often, and preserving code quality was the top-ranked goal for a policy. Other uses: 65 percent would allow AI-generated documentation with human review. 54 percent would allow AI tools on Project infrastructure, most of them with restrictions, and 29 percent would not. Only six percent for explicit discouragement, 16 percent for outright rejection, and 35 percent against LLM-generated documentation. This plus the usual sort of calls for responsible use and disclosure, concerns about copyright issues, and so on. The Reg is strongly reminded of the Debian developer poll we reported on in August. This had no fewer than four slightly different AI-refusal options out of eight, and despite the Condorcet voting method it uses, the result was giving permission to use bots. With such relatively weak opposition, we suspect that FreeBSD will go the same way as Debian: tell developers to be careful, but allow bot usage, resulting in LLM-extruded code being committed into the project. ®

Encountered some odd SQL Server connection behavior since the October update? There might be a culprit… Microsoft has admitted that a change has caused linked server queries to fail to close connections. Linked servers via OLE DB providers have been around for years and are a useful way of, for example, using additional data sources in queries. Once a provider is added, SQL Server can open a connection to grab data, and close it again when the query is complete. Or, at least, that's the theory. The problem is that after the October 13 (KB5126646) update, connections created by SQL Server linked server queries might remain open. According to Microsoft, "As additional queries are performed, connections to external databases can accumulate instead of closing as expected. "This can slow or degrade server performance after prolonged run time." You think? Administrators will likely have already noted a suspicious number of open connections to external databases on affected systems. Microsoft said the issue affects SQL Server linked server queries that use OLE DB providers to connect to external databases. It gave PostgreSQL and Oracle as examples of connections known to be affected. And the fix? "If idle connections can be identified, it is possible to manually close them to temporarily relieve server load. "It is also possible to temporarily restore system stability by restarting the SQL service." The Windows behemoth went on to state the obvious: "However, these steps can also interrupt active queries or transactions, and the problem can resurface again after sufficient operation time." Bouncing a SQL Server to deal with connection leakage is less than ideal, although it would at least be a good failover test and, let's face it, having to restart Microsoft services regularly is something many administrators will be all too familiar with. There is a mitigation available, although only through Microsoft support for business. Otherwise, an out-of-band update should be along within the next few days to deal with the problem. According to Microsoft, the technical glitch affects every version of Windows except Windows 11 26H2, stretching back to Windows 10 1809 and LTSC 2019, and Windows Server from 2025 back to 2012. Microsoft, or rather the unfortunate souls responsible for administering their server products, has not had the best time of late. The October 2026 Windows Server update left some Exchange Servers wobbling until either a Registry edit was made or a fix was applied as part of the November update. ®

European tech buyers are increasingly choosing cybersecurity vendors from their own continent in a bid to reduce their reliance on American technology. Digital sovereignty isn't only prompting enterprise customers to question their clouds of choice, it is also reshaping other parts of the industry too, and the shift is marked. According to sales figures compiled by Context, distributor sales in EMEA of cybersecurity products from EU-headquartered vendors jumped 35 percent in the two years to calendar Q3 2026. Total cybersecurity sales grew up 10 percent over the same period, and sales by US-run companies went up just 8 percent. That growth is from a relatively small base, though EU vendors gained nearly three percentage points to reach 15 percent of tracked sales by value. There is still a long way to go as US-headquartered vendors accounted for 62 percent. The trend coincides with a loss of trust in the Trump administration among customers outside of America, after it cosied up to autocratic rulers while criticizing and punishing allies with tariffs and more. Context stopped short of assigning blame. It said organizations are reviewing their reliance on third-party tech in light of EU compliance regimes: the NIS2 Directive and Digital Operational Resilience Act (DORA). NIS2, transposed into national law in October 2024, requires organizations in the bloc to raise their common level of security in the face of digital threats and risks to critical infrastructure. DORA, introduced in January last year, is designed to strengthen cyber security in the financial sector. "Digital sovereignty is becoming a buying decision. As customers and resellers get clearer about what it means in practice, they're asking who holds the encryption keys, who can access sensitive logs and where that data is stored," said Context veep of research Joe Turner. "We're seeing a measurable shift in the EMEA channel. EU vendors gained nearly three points of sales share in two years. An organization can keep its existing identity platform and still choose a European supplier to manage its security logs. That's the kind of decision that gives European vendors an opening." The stats indicate that EU-HQd vendors comprised 92 percent of tracked sales in security awareness training, 82 percent in vulnerability management, and 52 percent for SIEM and log management. US-headquartered companies held into 74 percent of identity and access management sales and 54 percent of cloud security sales. The Reg has asked Context for UK-specific figures to see whether British customers are also voting with their wallets for European alternatives. That certainly isn’t the case for tech purchases in the British public sector, despite Prime Minister Andy Burnham’s professed desire to buy British. Data released yesterday by the Institute for Public Policy Research showed just £1 in every £6 spent by government with the biggest technology suppliers goes to Brit businesses. Still, Burnham only came to power in July so there is time yet for him to put his money where his mouth is. Sovereign AI is another area of concern for enterprise customers. Analyst Omdia said last month that despite the marketing adjective meaning "local assets," almost a third AI providers disclose no proof of sovereignty, and some "expect enterprise to pay for audits to verify their claims." Omdia also found that 80 percent of contracts say network resilience is "out of providers control or responsibility," and "US-headquartered AI providers offer better service transparency and contract terms than a majority of local sovereign AI providers, with providers in India a notable exception." Sovereign services in Omdia's classification include data residency, operational autonomy, jurisdictional sovereignty, and technological autonomy. "Local hosting is not sovereignty. Serious providers must demonstrate their credibility through transparent operations, fair contracts and proof of competence. That includes the network, because data in transit must be sovereign too," said Camille Mendler, research director for telco B2B at Omdia. Someone should tell Microsoft and Anthropic. ®

More than 1,600 Rockstar Games employees in the UK will begin voting on union recognition on Thursday, with the ballot kicking off just a week before the long-awaited launch of Grand Theft Auto VI. The ballot, which opens on November 12 and runs until November 26, will determine whether Rockstar formally recognizes the Rockstar Game Workers Union, part of the Independent Workers Union of Great Britain (IWGB). Nearly all UK employees below director level are eligible to vote. If successful, the union would become the largest recognized union in the UK games industry, giving workers a collective voice. The proposed recognition agreement follows four months of negotiations between Rockstar management and employees. It would allow workers to negotiate over pay, overtime, pensions, bonuses, leave and other employment conditions, while securing consultation rights over HR policies and AI. The vote comes at a particularly busy time for Rockstar, with GTA VI finally due to arrive on November 19, more than 13 years after its predecessor. The game is expected to be one of the biggest entertainment launches in history, although the people responsible for making it have rather more immediate concerns than sales records. "I am incredibly proud of the work we've put into making this game. I'm also proud of the union we've built here. For me, those two things are connected," said Nestor Uriate, an animation programmer and Rockstar Game Workers Union representative. "We care deeply about the games we make, and we want to make sure we can continue doing that work in an environment where we're respected, have a meaningful say over our conditions and can feel secure about our futures." The vote follows a year of bad blood between Rockstar and the IWGB. The union accused the GTA developer of union busting after it fired 31 members in October 2025, claiming they had been singled out for taking part in a private Discord group. Rockstar denied the allegations, insisting the workers were dismissed for gross misconduct rather than their union activities. The dispute subsequently reached an employment tribunal, where Rockstar unsuccessfully attempted to have blacklisting allegations struck from the case. Closing submissions are expected on November 17 and 18, meaning the legal proceedings will reach their final stages just as GTA VI prepares to hit shelves. Despite the ongoing dispute, Rockstar's head of publishing, Jennifer Kolbe, recently indicated that management would respect the outcome of the recognition vote, telling Bloomberg: "We go where the team goes. So if they want a union, they will have a union." The union campaign has also attracted support from elsewhere in the games industry, including SAG-AFTRA and the Communications Workers of America (CWA), which represents workers at Blizzard. Alex Marshall, president of the IWGB, said the vote was an opportunity for Rockstar employees to take greater control over their working conditions. "What happens at Rockstar matters beyond the studio. Workers across the games industry are watching, and this ballot is an opportunity to show what can be achieved when people come together, organize and build the collective power to shape their own working lives." For Rockstar, November was already shaping up to be a big month. By the time GTA VI has been in players' hands for a week, the company should also know whether its UK workforce has voted to secure a formal seat at the negotiating table. ®

A new extension brings a working global menu bar to the GNOME desktop, even for some apps that don’t have menu bars at all. Orbit Global Menu is a new GNOME extension that gives the GNOME desktop a feature it was intentionally designed without, and one that some users miss very badly – this vulture being one of them. It adds a working global menu bar to the GNOME top panel. We suspect this is something that will cause strongly contrasting opinions among many GNOME users: some will by puzzled why anyone would bother, while others may think "at last!" and rush to try it. There have been other attempts to do this before, and the Reg FOSS desk has tried several of them, but we never found one that worked with the majority of applications. Our fondness for this UI feature was visible in the two-part series we wrote in September on how to customize Xfce and then in part two how to get the global menu working with more apps. The problem is getting worse over time, as in recent versions (since GNOME 40 and Gtk4), the GNOME human-interface guidelines encourage smartphone-style hamburger menus, replacing the traditional horizontal menu bar. It is tricky to add global menu bar support to apps that lack a menu bar, but Orbit's developer "Unmade" found a rather labor-intensive solution. The menu bar applet contains maps of keyboard controls for 292 different apps, so it can show a menu all on its own and then send those apps simulated keystrokes to operate it. It's not the programs' full menu trees, just a subset of them, but it works. It's also not the most elegant solution, but it is a solution and it works. We tried it on Ubuntu 26.10 and every app in the full install worked to at least some extent. If you are willing and able to build and install a small additional connector, it lets the global-menu applet talk to lots more applications. The GNOME shell is unusual among open source desktop environments, to an extent that we have criticized before. GNOME Shell was designed with a distinctive look and feel of its own, unlike almost all other desktops. It has a minimalist, stripped-down layout that doesn't look or work quite like anything else, and it's intentionally not very customizable. To change how GNOME works means writing new Javascript code, then packaging it as an extension that users can install from the GNOME Extensions website. This requires both a browser extension and a "native host messaging" connector to be installed into the underlying OS – or a purpose-written app. By default, the desktop comes with neither. The end result is that GNOME lends a visual identity to the Linux desktop, one that is clear and distinct from either Windows or macOS. (Back in 2013, this vulture argued that when Microsoft threatened to sue multiple Linux vendors over infringing Windows UI patents, some 20 years ago, this UI fragmentation was just what the company wanted.) GNOME 2 was the Linux world's default desktop. GNOME Shell was controversial in its early days, and lost pole position, but it has since won it back. Today, GNOME is the default desktop on all the major distros: Ubuntu, Fedora and Red Hat Enterprise Linux and the RHELatives, as well as Debian and SUSE, all default to GNOME. GNOME does away with a lot of features that are significant functional parts of other graphical desktops. For instance, it has no desktop icons, no system tray or defined place for status indicators, and neither GNOME nor GNOME-compliant applications have menu bars, either inside windows (Microsoft style) or in the top panel (Apple macOS style). This is disorienting and confusing for those used to controlling software mainly using their menus – but now, that's mainly older hands. This design suits those who grew up on smartphones and tablets, or who feel more comfortable with their stripped-back keyboardless UI than a full desktop WIMP, which can be overwhelming to newbies and non-techies. If you've followed the evolution of graphical desktops for some 40 years, as this gray-plumed vulture has, some trends are very apparent that aren't so clear if you came in once evolution was underway. Apple introduced the first global menu bar in the Lisa, and improved on that in the Macintosh. DR GEM copied it very early on, but Apple sued and DR changed the PC version of GEM to be less Mac-like. Microsoft's Windows came along after this, and moved menu bars inside windows instead. When Apple acquired NeXT in 1996, it moved NeXTstep's patent-avoidant vertical menus back to a global bar at the top, along with the clock and some status indicators. There they remain, 30 years later. In 2007, it launched the iPhone, containing a very cut-down OS based on OS X, replacing the Finder with a cut-down version of the Dashboard layer from OS X 10.4. The panel remained, shorn of its menus, which were too fiddly for a small screen. As The Register mentioned in 2017, in its preliminary releases, Android started out as a keypad-driven Java phone that looked and worked very much like BlackBerry. When the iPhone appeared, Google changed course. The new Android UI resembled iOS, complete with that top panel, still without menus. GNOME 3.0 was not far behind: in 2009 the team promised a revamp of the user experience, and in 2011, launched GNOME 3.0. It too has the fixed top panel — now huge on a laptop or desktop landscape screen – and mostly empty. Now that top panel regains its original 1983 function. We're rather impressed by the Orbit global menu. It does the job, and it even works with apps that don't have menu bars. It's not perfect: for instance, over-long menus have to scroll, and may fail to do so if new submenus appear. The GitHub repository has extensive instructions, including how to build and install the optional connector module that lets more apps export their real menus to the extension. It also tells you how to instruct some apps, notably Firefox, that there is a global menu for it to use. We are saddened to note that, as is so often the case, Wayland gets in the way here. It works rather well with some other extensions, too. With a menu bar, GNOME's strangely centered clock seems out of place, but several extensions, such as Frippery Move Clock, shove it over to the right where we still feel it belongs. If you prefer a lighter-colored panel and dock, it also plays nicely with Blur my Shell. ®