Bewarethewumpus

Well, this is cool. You can now download Unreal Tournament 2004 for free and with a patch that ensures it'll run smoothly on modern hardware. This is all thanks to a fan community called OldUnreal, who've made it their mission to keep Epic's classic shooters alive, even going as far as getting the Fortnite publishers' permission to do so.

Read more

The crowd and camera operators at the women's team sprint qualifications in Milano-Cortina got a surprise extra competitor when a local dog joined the race. The full video from NBC Sports is unfortunately not embeddable, but it's a must-see.

The two-year-old named Nazgul is a Czechoslovakian Vlcak, or wolfdog, a challenging breed that looks like a wolf. — Read the rest

The post Very good dog finishes third in Olympic cross country sking appeared first on Boing Boing.

Correct me if I'm wrong, but there's a shortage of things to worry about right now when it comes computing-adjacent hardware. Personally, I'm finding the AI boom, memory crisis, tariffs, over-priced GPUs and all that simply isn't enough to be getting on with. So, here's something else to get us all vexed, a good old-fashioned health scare in the form of concerns over headphones and toxic chemicals.

As reported by the Guardian, a new study by ToxFree LIFE for All, a Hungarian research and campaigning body, found that headphones contain chemicals that can, "cause cancer, neuro-developmental problems and the feminisation of males".

Upon immediate examination, one of the more worrying claims in the study is that at least some of these chemicals were found in each and every set of headphones tested. That includes, it is said, major brands such as Bose, Panasonic, Samsung and Sennheiser. So, to the extent that this is a major problem, it's not reserved to cheap knock-offs.

Apparently, the primary source for the chemicals is the "formulation of the plastics from which they are made". The dangerous substances are said to include bisphenols, phthalates and poly- and per-fluoroalkyl.

The study claims that Bisphenol A (BPA), for instance, appeared in 98% of samples, while its substitute substance, bisphenol S (BPS), was found in more than three-quarters. These chemicals are apparently used to stiffen plastic and "mimic the action of oestrogen inside organisms, causing a range of adverse effects including the feminisation of males, early onset puberty in girls, and cancer."

The study doesn't make clear exactly how much exposure to such devices is assumed to be required to reach toxic levels. But it concludes, “given the prolonged skin contact associated with headphone use, dermal exposure represents a relevant pathway, and it is reasonable to assume that similar migration of BPA and its substitutes may occur from headphone components directly to the user’s skin.”

At this point, then, the implication is that the chemicals are present according to one study; that's as far as the research has gone. Moreover, the study did emphasise that many chemicals were only found in "trace" quantities, and thus not likely to cause harm.

However, ToxFree LIFE for All says that, "highest concentrations of harmful substances were found in the hard plastic parts of the headphones. These chemicals can be released into the environment through heat, mechanical stress or sweating and then absorbed through the skin."

As for what any of us can do about all this, it's advised to use speakers if you don't have to wear headphones, if you do wear headphones, don't do so all day, and don't sleep with them on.

The body also points out that, in the EU at least, headphones are subject to the same regulations as TVs, despite the very different usage profile. It is calling for a new category of regulation for "wearable" electronics.

Anyway, if you have the mindspace for it, what with all the other health concerns that seem to hit news pages daily, this is certainly something to consider. It's also an interesting insight into how intuitive or otherwise this kind of risk can be.

From a purely lay perspective, one might assume that softer materials would be more likely to pose a risk of toxic material transfer and that harder plastics are more stable. But at least for the chemicals in question here, it's the opposite. For glasses wearers, it's also hard not to suddenly wonder what your frames are made of. But that is a story,—and an anxiety—for another day.

Despite banging on about data privacy, my password practices are perhaps not actually that secure. No, I'm not leaving them lying around on post-it notes like my office is just the latest level of an immersive sim, but a recent study suggests that cloud-based password managers ain't it either.

A number of these services tout their 'Zero Knowledge Encryption,' insisting that no one besides you, not even the service itself, can sneak a peek at the contents of your password vault—in theory, anyway. According to a fresh study by a team of security researchers out of ETH Zurich and Universita della Svizzera Italiana, zero knowledge encryption is far from airtight in practice (via Ars Technica).

By closely analysing or reverse-engineering a number of different vendors—including LastPass, Bitwarden, and Dashlane—the team of researchers found "a cornucopia of practical attacks." The paper notes, "Worryingly, the majority of the [team's devised security] attacks allow recovery of passwords—the very thing that the password managers are meant to protect."

Some of the researcher's devised attacks take advantage of vulnerabilities within various password managers' key escrow mechanisms.

For instance, when an admin of a shared password vault either invites a new member or attempts to reset a member's forgotten access code, a number of 'keys' are generated. These keys are sent to the software client of the member in question. The client bundles all of these keys together and encrypts them locally before sending them back to the password manager's server.

The researchers found the resulting ciphertext is not always integrity-checked, meaning a bad actor could swoop in, swap one of the keys sent to the client out for one of their own paired keys, and then use that to decode the resulting ciphertext. This could allow someone to extract a shared vault's key, which could then be used to perform an account recovery on a targeted member of the shared vault. Key pair manipulation can also be used to decrypt and directly modify shared items within a password vault.

To return to the case of inviting a new member, the most unnerving wrinkle to the key escrow attack is that a bad actor could run rampant through a member's vault as soon as the initial invitation to join was accepted.

The team delve into a number of other potential attacks throughout the paper, targeting both multiple password managers' backwards compatible support of older versions, and even a threat model where the server is "fully malicious, meaning that it can deviate arbitrarily from its expected behaviour."

The team found, "Despite [encrypted password vault] vendors’ attempts to achieve security in this setting, we [uncovered] several common design anti-patterns and cryptographic misconceptions that resulted in vulnerabilities."

Long story short, either an employee working for your password manager of choice, or a malicious actor that has managed to infiltrate its servers, could potentially get more than an eyeful of your passwords. That said, I still doubt Motorola's proposed 'password pill' was ever the future, to say nothing of trying to keep all of your passwords memorised in your very own fallible noggin'.

But even with the paper's findings in mind, password managers are still the best way to store piles of unique passwords—though there are ways to keep your data safe without going to too much hassle. It's a good idea to have your recovery account connected to these services using a separate password that is not included within the password manager's vault, and you should also set 2FA authentication with a separate service to deal with your codes.

The US government spent decades funding the development of tools like Tor, which helps millions of people route around censorship and surveillance in countries like Iran, China, Cuba, and North Korea. As of mid-2024, about 35% of the Tor Project's $7.3 million budget still came from federal sources, with the State Department's Bureau of Democracy, Human Rights, and Labor alone contributing over $2.1 million in 2023-2024 for expanding uncensored internet access in China, Hong Kong, and Tibet. — Read the rest

The post Trump's aid freeze is killing US-funded privacy tools like TOR appeared first on Boing Boing.

Click here to go see the bonus panel!

Hovertext:
You can actually do a lot of low-risk leveling up of the relationship just by using a bot to have your character run around stabbing rats all day.

Not to sound like an old coot (though I am) but there's at least one aspect of gaming that used to be a lot harder. If you got stuck on an adventure game puzzle in the 1980s, you couldn't just ask the entire world for help: the internet hadn't been invented yet. You just had to bang your head against that puzzle until you figured it out—the closest thing to the internet was the occasional pay-per-minute hint line or asking the developer for help via mail. Not email, old-fashioned mail.

If that wasn't bad enough, '80s adventure game puzzles were notoriously illogical and you'd have to twist your brain into a pretzel to figure these darn things out. Today, with puzzle solutions just a Google search away, it's difficult to experience that true desperation.

But this month there's a chance to test your mettle against a dastardly '80s adventure game the way God intended: no cheats, no Google searches, and absolutely no walkthroughs.

Developer Woe Industries has announced the AGAT, or "Adventure Game Aptitude Test," which is "a standardized examination designed to assess if anyone can still complete an '80s adventure game without a walkthrough."

I know it sounds like a cute experiment, and it is—but it's also not kidding around. "To ensure no walkthroughs or other outside sources are consulted during play, we will be utilizing college exam proctoring software, which will monitor your smartphone usage and browser activity."

I was able to get an advanced look at the AGAT this week, and I can confirm: funny as this sounds, it's legit. Woe Industries has built a website that indeed hosts an actual 1980s adventure game (I will not say which one) and uses actual proctoring software called AutoProctor that (using AI) watches your face through your webcam and monitors your browser window to make sure you're not looking away from the quiz to find answers or using another browser tab to search for a walkthrough.

Move your head too far from the exam on your screen, switch to a different window or open a new browser tab, or even make suspicious noises (it listens through your mic as well) and Woe Industries will be sent a report on your "violations" during the quiz.

I'm sure some of you still in school or university may have had to use proctoring software already, but this is all new to me. I don't love an AI suspiciously peering at me and evaluating my trustworthiness while I'm playing a game, but this is a pretty fun and ridiculously elaborate experiment Woe Industries has cooked up.

It's not the first, either. Woe Industries has developed some funny and interesting browser games over the years, like FromSoft Word—it's like Microsoft Word but if you make a typo, you die—and Myst FPS—it's Myst but you shoot a lot of stuff, too. For the AGAT, they're really going above and beyond.

Don't believe me? The AGAT is only available on February 28, 2026, between the hours of 1:00 and 2:00 pm EST. This is a standardized test, after all. Everyone has to take it at the same time to prevent rampant cheating!

If you choose to take the exam and complete it successfully, you'll get a nice little diploma, too. Isn't that better than some achievement? To find out more about the AGAT, and make sure you get a reminder in time for exam day, here's the official site.

And if you'd like an adventure game warmup, here's a little adventure game quiz of our own.

Texas-based pet microchip registry Save This Life abruptly shut down earlier this month, potentially leaving hundreds of thousands of pets unprotected.

Microchipping is vital for protecting pets. Pets run away or get lost, and collars and tags can fall off. A microchip can be the difference between getting a pet back and losing them forever. — Read the rest

The post Pet microchip company went out of business and took your pet's info with it appeared first on Boing Boing.

The Board of Peace is an intergovernmental organization started by U.S. President Donald Trump that is meant to promote peacekeeping, founded to implement a peace plan and oversee the reconstruction of the Gaza Strip following the Hamas-Israel conflict.. The Board of Peace was announced in September 2025, mandated that November and the founding charter was signed on January 22nd, 2026. The Board of Peace was met with criticism by some, who found its existence unnecessary and likened it to a club. By January 23rd, 2026, about 22 countries accepted their invitations to join the board, while countries including France, Norway and Sweden declined, and countries including Italy, Germany and Russia were noncommittal.

In January 2026, Canada's invitation to join the Board of Peace was revoked after Canadian Prime Minister Mark Carney criticized Trump's use of tariffs as a weapon.The Board of Peace became the increasing subject of memes in January 2026, including memes that imagine the members of the Board of Peace as notable villains.

Attorney General Pam Bondi told Congress on Saturday that the Justice Department has released all documents required by the Epstein Files Transparency Act. The lawmakers who wrote the law disagree.

In a six-page letter, Bondi and Deputy AG Todd Blanche listed more than 300 "politically exposed persons" whose names appear in the files — Trump, Clinton, Gates, Prince Andrew, and, for reasons the DOJ didn't explain, Princess Diana, Elvis Presley, and Janis Joplin. — Read the rest

The post Bondi says all Epstein files are released. Lawmakers say she's lying. appeared first on Boing Boing.

Wall Street Journal says Claude used in operation via Anthropic’s partnership with Palantir Technologies

Claude, the AI model developed by Anthropic, was used by the US military during its operation to kidnap Nicolás Maduro from Venezuela, the Wall Street Journal revealed on Saturday, a high-profile example of how the US defence department is using artificial intelligence in its operations.

The US raid on Venezuela involved bombing across the capital, Caracas, and the killing of 83 people, according to Venezuela’s defence ministry. Anthropic’s terms of use prohibit the use of Claude for violent ends, for the development of weapons or for conducting surveillance.

Click here to go see the bonus panel!

Hovertext:
He's lucky it wasn't Talk While Burping day.

Most high school shop programs produce birdhouses and bruised thumbs. In Sandpoint, Idaho, students spent their Saturdays building two full-scale aircraft, earned FAA airworthiness certificates, and then watched one of their own take them into the sky.

The morning of October 4, 2025, marked a turning point for the North Idaho High School Aerospace Program.

— Read the rest

The post Idaho high schoolers build two airplanes, then go fly them appeared first on Boing Boing.

Protesters have been blowing whistles to alert people to agents’ presence – and that has upset figures on the right

When Justin Vernon of Bon Iver appeared on the red carpet at the Grammy awards he was wearing an accessory that has become a must-carry for activists in neighborhoods targeted by ICE: a whistle.

The whistle has become a key part in the defense against Donald Trump’s aggressive immigration crackdown, used to alert people to the presence of agents. But it has also become a target for the right, who have branded whistles “hearing-loss-causing machines” and said the act of blowing a whistle may constitute “assault”.

Ransomware is a nasty bit of malware. Effectively, it locks down your device, and the only way of potentially getting access back is by paying hackers to get it removed. At least, that's what ransomware is supposed to be. Recently, a new one has been spotted that couldn't be removed even if the hackers wanted to.

Nitrogen's ESXi ransomware, as spotted by Coveware (via The Register), has a "coding mistake in the ESXi malware [that] causes it to encrypt all the files with the wrong public key, irrevocably corrupting them."

Effectively, once ransomware gets into your device (often via suspicious links or PC vulnerabilities), it then encrypts your valuable files and stores a randomly generated key that only it knows. That key can then be used to decrypt files. It's like someone who spots you removing your lock from a locker and putting theirs on instead. Thus, affected users are forced to fork out cash to bad actors on the chance they can actually get the files back.

Coveware points out that when the public key is accessed, the ransomware mistakenly overwrites the first four bytes of the key, which means "no one actually knows the private key that goes with the corrupted public key." Modern-day encryption relies on having a public key and secret private key, both required to unlock a device. Without both parts, the data cannot be accessed. There's no point guessing, either, as the whole point is it would take a computer an impossible amount of time to brute force unlock the data.

Essentially, even if you pay the ransom, the hackers are incapable of getting back into your files. Though even if Nitrogen can't get your files back, that likely won't stop them from asking for payment if they get into your device.

This ransomware is reportedly a coding offshoot of the Conti 2 builder code. Conti is a type of Malware from the hacking group 'Wizard Spider' that was created in 2019. In 2022, a splintering of the group formed due to political differences over the Russian invasion of Ukraine and a leak of the builder code happened as a result.

There's no word yet on how widespread this specific offshoot of the builder code is, but its target is VMware ESXi hypervisors. Being software that runs and manages virtual machines, it could mean a virus gains access to not just a device but a mass of devices. That being said, it's a lot more niche than a more traditional virus.

Naturally, there's no way of guaranteeing a hacker will obey the contract you've made with them, even if they're capable of getting into files. And, as a result, the best way to prevent ransomware from destroying your files is to try not download any weird gunk on the internet to begin with.

songpasserine:

journeymanfool:

victusinveritas:

victusinveritas:

Here’s this from The Atlantic

link without paywall

Tom the Dancing Bug: Are You a Dangerous Criminal? A Handy Quiz

👉 Please join the team that makes it possible for your friendly neighborhood comic strip Tom the Dancing Bug to exist in this hostile Trumpverse! JOIN US FOR 2026 IN THE INNER HIVE, and be the first kid on your block to get each week's Tom the Dancing Bug comic – before it's published anywhere. — Read the rest

The post Tom the Dancing Bug: How to find out if YOU are a dangerous criminal appeared first on Boing Boing.

Not everyone is happy with the introduction of AI into... well, everything they use on a daily basis, and it appears Mozilla has been listening. After considerable backlash towards its announcement that Firefox would become an 'AI browser' over the next few years, it looks to have changed its tune in recent weeks.

Beyond the declaration that it's building a 'rebel alliance' to challenge Big Tech's current plans for AI-integrated toasters and the like, it's now announced a new AI controls section within the browser's settings menu.

It'll begin rolling out in Firefox 148, which is due to release on February 24, and looks to be an easy way to block "current and future generative AI features" within the browser.

Per Mozilla's Firefox blog: "AI is changing the web, and people want very different things from it.

"We’ve heard from many who want nothing to do with AI. We’ve also heard from others who want AI tools that are genuinely useful. Listening to our community, alongside our ongoing commitment to offer choice, led us to build AI controls."

The new menu allows you to turn on or off a host of AI features, including translations, alt text in PDFs, AI-enhanced tab grouping, link previews, and an AI chatbot in the sidebar.

"You can choose to use some of these and not others. If you don’t want to use AI features from Firefox at all, you can turn on the Block AI enhancements toggle," says Mozilla. "When it’s toggled on, you won’t see pop-ups or reminders to use existing or upcoming AI features".

Your AI preferences also stay in place across updates, apparently, which should hopefully prevent a random AI feature from bouncing its "We've added a doohickie!" message across your browser window because you dared to keep your software up to date. Hopefully. We can only pray.

As a Firefox user myself, I have to say this is pretty encouraging. Some of these features were already capable of being disabled within one of the browser's labyrinthine settings pages (or in the about:config panel), but grouping all the stuff I want to turn off in one easy menu seems like a genuine improvement.

If you want to try it out early, Mozilla says the controls will also be available in the Firefox Nightly beta builds, although I tried one once and it broke many things. Your mileage may vary, but at least your anti-AI browser crusade might come one step closer to fruition.