Thursday, 02 July 2026

US Supreme Court ruling unravels the EU-US data transfer framework; a six-year-old FUSE bug gives root on nearly every Linux distro; Sony deletes 551 purchased movies from PlayStation libraries

Today's Lead

Engineering

noyb.eu

US Supreme Court Ruling Blows Up the EU-US Data Privacy Framework

The US Supreme Court's ruling in Trump v. Slaughter, which strips the FTC of its statutory independence under the 'unitary executive' theory, has kicked out the load-bearing pillar of the EU-US Data Privacy Framework: the European Commission's 2023 adequacy decision cites the FTC's independence 259 times as the legal basis for treating US data protection as equivalent to the EU's. With that independence gone, any company relying on the DPF, Standard Contractual Clauses, or Binding Corporate Rules to move EU personal data to US servers is now operating on a foundation the EU's own adequacy finding no longer supports. Fixing it would require unanimous agreement from all 27 EU member states — a near-impossibility given current political alignment — while legal challenges at the Court of Justice of the EU are expected within weeks but typically take two to three years to resolve. In the meantime, any company doing US-EU data transfers, especially cloud and SaaS providers, faces a multi-year window of regulatory uncertainty and potential retroactive liability, with no clean technical or contractual fix available.

Read →

Engineering

cyberstan.co.uk

Six-Year-Old FUSE Kernel Bug Gives Unprivileged Root on Nearly Every Linux Distro

CVE-2026-31694 is a missing bounds check in the Linux kernel's FUSE readdir path that lets a malicious FUSE daemon return a directory entry larger than PAGE_SIZE, overflowing 24 bytes into an adjacent kernel page. The bug has existed since 2019 but was unreachable until a December 2024 commit raised FUSE_NAME_MAX from 1024 to 4095 bytes, quietly opening the door. Exploitation is reliable rather than probabilistic: by grooming the page cache, an attacker can steer the overflow to corrupt /etc/passwd and log in as root via su, without needing any other kernel bug, capability, or namespace escape — and standard mitigations like AppArmor and SELinux don't stop it. The flaw reaches both desktop distributions (via the fusermount3 setuid helper) and servers (via unprivileged user namespaces), and the fix is a single added bounds check — a reminder that pagination-layer arithmetic in code that's been stable for years can still be silently reactivated by an unrelated, seemingly cosmetic change elsewhere in the kernel.

Read →

F-Droid

F-Droid Calls Google's New Android Developer Verification a Malware Risk in Disguise

F-Droid published a pointed rebuttal to Google's upcoming Android Developer Verification (ADV) program, which will require all developers — including those distributing outside the Play Store — to register identity with Google before their apps can run on certified Android devices, rolling out in Brazil, Indonesia, Singapore, and Thailand from September 30 with global expansion planned for 2027. F-Droid's objection isn't just about friction: it argues ADV gives Google unilateral, non-transparent authority to decide what counts as acceptable software across the entire Android ecosystem, collapsing a historically open distribution model into a single corporate chokepoint under the banner of anti-malware protection. The Hacker News discussion (120 points, 39 comments) split between engineers alarmed at the centralization precedent and others skeptical of F-Droid's inflammatory framing, while EU commenters flagged the program as a plausible Digital Markets Act target. It's a concrete instance of a recurring platform-governance pattern: security justifications used to construct gatekeeping infrastructure whose scope quietly outgrows the threat it was built to address.

Read →

Reclaim The Net

Sony Pulls 551 Purchased Films From PlayStation Libraries, No Refunds

Sony is delisting 551 StudioCanal films from PlayStation users' libraries on September 1, 2026 — content those users paid full price for — with no refunds offered, because the underlying B2B licensing agreement between Sony and StudioCanal lapsed and platform terms of service treat a 'purchase' as a revocable license, not a permanent asset. The gap between storefront language ('buy') and the actual legal relationship is the story: consumers reasonably read 'buy' as ownership, but the technical and contractual architecture underneath makes access contingent on upstream deals they never see and can't negotiate. The Hacker News discussion (550 points, 252 comments) situated this within a longer Sony pattern — the PS3 OtherOS removal, the 2005 rootkit scandal — and pointed to proposed legislation like California's AB 2426, which would bar platforms from using 'buy' language for anything less than permanent access. With console gaming this concentrated, critics argue regulation, not consumer choice, is the only lever left to close the gap between what people think they're buying and what they're actually licensed to use.

Read →

Cloudflare Blog

Cloudflare Splits Bot Traffic Into Search, Agents, and Training — With Training Blocked by Default

A year into its 'Content Independence Day' initiative, Cloudflare is replacing binary bot-blocking with a three-way split: search-indexing crawlers, real-time AI agents browsing on a user's behalf, and model-training crawlers, each governed separately. Starting September 2026, ad-supported sites will block AI training and autonomous-agent crawlers by default while continuing to allow search indexing — encoding an assumption that ad-monetized content implies a preference for human-audience traffic over silent value extraction by training pipelines. The new 'Content Use Levels' let bot operators declare intended use (immediate reference vs. full reproduction) as a machine-readable signal, an attempt to build governance into the protocol layer rather than rely on legal terms nobody enforces at scale; a new Enterprise tool, BotBase, gives site owners visibility into which bots are actually hitting them. Notably absent is any data on how much traffic or revenue this has actually redirected back to publishers — a year in, the initiative is still more architecture than proof of impact, and its success depends on crawler operators choosing to comply with signals Cloudflare has no way to enforce beyond its own network.

Read →

LeadDev

Token Hygiene Is Becoming Its Own Engineering Discipline

LeadDev reports that the biggest driver of runaway AI infrastructure costs isn't model pricing but context dumping: engineers routinely paste entire log files when only the error line matters, or whole codebases when a function would do, inflating token bills without improving output quality. The piece cites one team's single debugging session costing $287 in token spend before they audited usage; after adopting selective compression, context caching, and data-type-specific trimming, the same organization cut an estimated $700,000 from its annual AI bill. The framing shift is the interesting part: treating tokens as a constrained resource to be budgeted and attributed per team, the way cloud compute costs already are, rather than an unlimited input you throw more of at a problem to get a better answer. As AI-assisted workflows get embedded deeper into everyday engineering, LeadDev argues cost observability and prompt discipline need to become as standard as query optimization or dependency hygiene — a lesson arriving the hard way, one surprise invoice at a time.

Read →

Works in Progress

How 17th-Century Amsterdam Solved Fire Risk With Organizational Design, Not Just Technology

Between the 1670s and 1680s, Amsterdam went from a city repeatedly devastated by uncontrollable fires to a model of urban fire safety — and the breakthrough wasn't primarily the suction hoses and flexible leather hose invented by painter-engineer Jan van der Heyden, but the institutional scaffolding built around them. After catastrophic fires in 1669 and 1672 exposed the limits of existing pumping engines and bucket brigades, the city mandated 36 trained volunteer firefighters per district with enforced service obligations, built nested command structures, and calibrated incentives precisely: rewards for fast response, fines for delayed alarms, and penalties for households that tried to extinguish fires themselves instead of calling for help immediately. The results were measurable — fire losses fell below one percent of the prior decade's total across 41 incidents between 1682 and 1687 — because the new hose technology only worked once paired with a command structure that got it to the right place, fast, every time. It's a clean historical case for a principle that keeps resurfacing in modern safety engineering: critical systems don't fail because a single component breaks, they fail when technology and the organization around it are misaligned, and fixing one without the other doesn't move the needle.

Read →

Marginal Revolution

US Moves to Legalize Civilian Supersonic Flight, Trading a Speed Ban for a Noise Standard

The Department of Transportation has proposed repealing the 53-year-old ban on civilian supersonic flight over US land, in place since 1973, and replacing it with a noise-based standard rather than an absolute speed limit — betting that modern noise-suppression technology can manage the sonic-boom concerns the original ban was written to prevent. It's the first substantive revision of the rule in half a century, and it reframes the regulatory question from 'how fast' to 'how loud,' which sounds like a technical simplification but is really a bet that industry compliance with acoustic thresholds will hold up as well in practice as a hard speed cap did on paper. That's the part getting the least scrutiny: performance-based standards trade the clarity and enforceability of a bright-line rule for flexibility that depends on measurement, monitoring, and follow-through, none of which are settled yet for a technology that hasn't operated at scale over populated areas in decades. The environmental and community-noise tradeoffs the original ban was designed around haven't gone away — they've just been handed to a newer, less-tested regulatory mechanism to manage.

Read →

Marginal Revolution

The Best Way to Ask a Stranger for Help Is to Make It Easy to Say No

New research on help-seeking finds a counterintuitive rule: the way to get more help from strangers is to minimize the cost of refusing, not just the cost of accepting. The mechanism is relational — help given under social pressure breeds resentment and forecloses future cooperation, while help someone was genuinely free to decline creates a real basis for trust, so requests that are specific, bounded in time, and delivered through low-pressure channels like text rather than a phone call outperform persuasion-heavy asks. This inverts the usual instinct in help-seeking, which is to minimize the odds of a 'no' through framing and social pressure; the finding is that explicitly making refusal easy paradoxically increases the rate of genuine, voluntary help, because it removes the grudging-compliance dynamic that makes people quietly resent having helped at all. It's a small result with a broad footprint — for anyone designing systems where people have to ask each other for things, from open-source maintainer requests to workplace favors, the lever isn't persuasion, it's lowering the exit cost.

Read →

Humanities

JSTOR Daily

Archivists Rediscover Ireland's Only Jewish Newspaper, Published as Hitler Took Power

The Jewish Gazette, published in Belfast for just thirteen issues between 1933 and 1934, was Ireland's sole Jewish periodical — and Queen's University Belfast has now made the full run accessible via JSTOR, capturing a small community's real-time reaction to Hitler's rise and the opening moves of Nazi persecution. Beyond tracking the 'German Anti-Jewish Campaign' as it unfolded, the paper devoted real space to poetry, theater, and historical essays on early Jewish settlement in Ireland — using cultural material to do the work of asserting belonging in a moment of acute external threat, not just reporting on it. The rediscovery matters because it complicates a tidy national narrative: despite centuries of residence, Ireland's Jewish community described a persistent mutual estrangement from broader Irish identity, and the Gazette is a rare direct artifact of a minority press navigating dual, uneasy belonging while the ground was shifting abroad. It's a small case study in how a community under pressure uses its own media not just to inform but to construct memory and identity in real time, with an audience of readers who needed both.

Read →