A critical flaw has been discovered in Notepad (CVE-2026-20841). That once simple Windows editor that only displayed plain text, you know? The one that Microsoft tainted with Markdown (the vector for this flaw), Copilot, and who knows what else? An attacker could place a malicious link in a Markdown file that, when clicked by the victim, would execute code remotely. A fix was made available by Microsoft in routine updates released on Tuesday (10th).
Asides
The Gemini protocol (not to be confused with Google's AI) continues to exist. On Sunday (8th), it got a significant boost on Apple devices with the launch of Lagrange, a browser for the small web that took 4.5 years to complete. In addition to Gemini, the browser also works with classic protocols such as Gopher and Finger, and other hobbyists. Free, for iOS/iPadOS.
From Anthropic's “studies” claiming that Claude did this or that to Moltbook, a “social network for AIs” (which seems to be a lie), it's always the same story depicted in the comic strip above: people telling AI to behave in a certain way being shocked when AI behaves in that way.
Regarding Moltbook and its foundation, OpenClaw, I will limit myself* to giving one piece of advice: don't use it. The tool open the doors to your private digital life, with unpredictable consequences.
* I limit myself to this because, in my opinion, the press is doing a huge disservice by legitimizing this nonsense.
The way Signal is built — with people's privacy as a priority — makes it difficult and slow to release features that other apps have had for a long time. They take a while, but they get there. The latest version, now available, introduces pinned messages in individual and group chats. It works on Android, computers, and iOS.
For me, NetNewsWire is the perfect app for macOS. NetNewsWire 7.0, released this Tuesday (27th), reinforces this distinction. The implementation of Liquid Glass is so good that the app looks better (screenshots), without losing its identity. Extra points for the icon-free menus, mitigating one of the silliest problems in macOS 26 Tahoe. Now I’m looking forward to the iOS version.
In his annual message to the public, YouTube CEO Neal Mohan says that “AI will be a boon to the creatives who are ready to lean in” and that more than a million channels used AI to create videos daily in December. At the same time, he promises measures “to reduce the spread of low quality AI content.” These seem like contradictory promises. Good luck to him.
The new version of Nova Launcher, a popular launcher for Android, brought an unwanted new feature: advertising trackers from Meta and Google. On Exodus, a non-profit app auditing platform, you can see the changes from the previous version (8.1.6) to the new one (8.2.4).
Nova Launcher was purchased by Sweden's Instabridge a few months after the launcher's creator left Branch, the company that bought the app in 2022 and promised to open its code — which never happened. Instabridge has confirmed that it is testing ads in Nova Launcher and that it will not display ads to those who have Nova Prime (paid version).
Once again, Google threatens the 3 billion (!) Gmail users with Gemini (AI) features. This time, the change is dramatic: the inbox will be “smart”, which would be tempting if AI models were capable of summarizing correctly (they are not) and were not prone to mistakes (“hallucination” is an euphemism for mistakes). For now, the new Gmail is being released to Americans who pay for Google's expensive AI plans. The prophylactic measure is to disable all AI features in Gmail: in the settings, General tab, uncheck the option Enable smart features in Gmail, Chat, and Meet. You're welcome!
People using a Logitech mouse on macOS spent a few hours with limited functionality. An expired certificate for the Logitech Options+ and G HUB apps caused the confusion. The ridiculous issue at least served to help people discover better alternative utilities for this purpose. (The best software, however, is no software; a good mouse works fine without these things, hehehe!)
The drawing for Brazil’s largest lottery prize ever — BRL 1 billion (USD 180 million) — was postponed due to the volume of bets, which reached 125,000 per second, 120,000 of them via digital channels. The draw, originally scheduled for 10 PM on Wednesday (31st), was moved to this morning. I hope they actually make it this time.
Via O Globo (pt_BR).
Mozilla said Firefox will have a “kill switch” that disables all AI features in the browser. Someone witty quipped it will be the “Uninstall” button.
It’s possible that Time magazine’s Person of the Year selection — which in this issue named “the AI architects” (i.e., big-tech AI CEOs) — was chosen by an AI. First clue: calling several people the otherwise singular “Person” of the Year. Second and stronger clue: only something as dumb as an AI would pick that bunch of clowns as Person(s) of the Year.
A few months ago, youtubers reported unsolicited interventions by Google to “improve” their videos with generative AI. It appeared to be a test; now it’s official.
Channel owners can disable this feature in Studio: go to Settings, Channel, Advanced settings and uncheck the two options under Video quality enhancements. For viewers, Google’s suggested workaround is to change the resolution in the player’s settings.
Many people were surprised to learn on the 20th that Signal uses Amazon/AWS infrastructure. Signal’s president, Meredith Whittaker, had to explain why:
Instant messaging demands near-zero latency. Voice and video in particular require complex global signaling & regional relays to manage jitter and packet loss. These are things that AWS, Azure, and GCP provide at global scale that, practically speaking, others (in the western context) don’t.
It’s important to note that Signal uses end‑to‑end encryption, which means nobody at AWS can access the content.
(By the way: the “reply guys” issue on Mastodon shows up in almost every technical post Meredith makes.)
I find it fascinating that so many people fall for the fallacy that artificial intelligence is reliable enough to guide decision‑making. And sometimes I find it funny, too.
Brazilian startup Jumpad is intriguing from the pitch itself: a “self‑hosted platform, deployed on the company’s cloud” that lets you enable APIs from external services like OpenAI and Google. Hm, okay. The service “involves engagement dashboards and gamified trainings, contributing to cultural transformation.” As an example of “cultural transformation,” we’re treated to this gem:
At one client, it was found that 25% of employees’ time was spent on calls and meetings, but about 80% of them were not actively participating. In other words, it was a huge waste of time.
Imagine having to burn the planet to “discover” that most meetings could have been an e‑mail.
(The information comes from Brazil Journal [pt_BR].)