🇯🇵 Japanese users are worried that X is damaging Japan's reputation by auto-translating "low-class" Japanese posts and pushing them onto your timeline, because X's algorithm rewards ragebait.
According to them, the feature mostly amplifies mockery of tourists, contempt for foreign cultures, and complaints framed in ways that were never meant to leave the island. All of it now surfacing in English, Spanish, Portuguese, and beyond, translated and pushed to users worldwide.
For decades, Japan's image abroad as a polite, harmonious society was protected by most foreigners not being able to read Japanese. The ugly corners of Japanese social media stayed local. The polished tourism ads went global.
That's gone now.
According to former TV presenter and YouTuber Kanon Aoki, X's auto-translation feature is pushing the rawest, most hostile Japanese posts straight into foreign timelines.
Aoki's frustration is direct. A minority of what she calls "low-class" Japanese users are now the loudest Japanese voices abroad, simply because the algorithm translates whatever gets engagement. The quiet majority stays invisible. The trolls go viral worldwide.
The result: foreigners' perception of Japan is shifting in real time, and there is no stopping it.
According to them, the feature mostly amplifies mockery of tourists, contempt for foreign cultures, and complaints framed in ways that were never meant to leave the island. All of it now surfacing in English, Spanish, Portuguese, and beyond, translated and pushed to users worldwide.
For decades, Japan's image abroad as a polite, harmonious society was protected by most foreigners not being able to read Japanese. The ugly corners of Japanese social media stayed local. The polished tourism ads went global.
That's gone now.
According to former TV presenter and YouTuber Kanon Aoki, X's auto-translation feature is pushing the rawest, most hostile Japanese posts straight into foreign timelines.
Aoki's frustration is direct. A minority of what she calls "low-class" Japanese users are now the loudest Japanese voices abroad, simply because the algorithm translates whatever gets engagement. The quiet majority stays invisible. The trolls go viral worldwide.
The result: foreigners' perception of Japan is shifting in real time, and there is no stopping it.
1🤣33❤4💩4🔥2🤔1💯1
Proton CEO Andy Yen warns that the global push for age verification is the quiet death of online anonymity, because every passport scan, selfie, and biometric uploaded for "verification" inevitably ends up leaked, hacked, or monetized.
He argues Big Tech and governments cannot be trusted to act as gatekeepers, and the only real protection for ID data is to never collect it in the first place.
Source: https://proton.me/blog/keep-age-verification-from-killing-anonymity-online
He argues Big Tech and governments cannot be trusted to act as gatekeepers, and the only real protection for ID data is to never collect it in the first place.
Source: https://proton.me/blog/keep-age-verification-from-killing-anonymity-online
👍35❤15👏4🔥3💩2🙏1
🚨🇪🇺 The European Commission is about to steal your search history in one of the largest forced data grabs in the history of the open internet, and almost nobody is talking about it.
The scope is staggering:
🔴 Every query you type
🔴 Every voice and photo search
🔴 Every autocomplete you accept
🔴 Your language, your device
🔴 Your country pinned to a ~3km² grid
🔴 Every result you saw, every link you hovered
🔴 Every click and scroll
🔴 The full chronological order of your search sessions
Meaning the European Union now knows your:
🔴 Health symptoms
🔴 Pregnancy
🔴 Sexual orientation
🔴 Political views
🔴 Religious beliefs
🔴 Financial distress
🔴 Legal trouble
🔴 Addictions
🔴 Affairs
Under the proposed measures for DMA Article 6(11), Google would be ordered to ship the daily search behaviour of hundreds of millions of Europeans to multiple third parties through a daily API feed. Any approved "online search engine," AI chatbots included, would get five years of access.
The things people only ever type when they think no one is watching. All of it now scheduled to flow daily into an open-ended list of third parties scattered across the European Union.
Brussels promises "anonymisation." The reality is a thin technical veneer that has been broken in academic literature again and again for over a decade. Search behaviour is a fingerprint. Stripping a name does not change that.
Mass data leaks become inevitable. Every new beneficiary is a new attack surface, and every annual audit is a year of silent exposure between checks. The 2025 Discord vendor breach already showed how fast 70,000 government IDs can leak through a single weak link. Now imagine that link holding Europe's search history.
Surveillance without consent becomes the default. Hundreds of millions of EU citizens never agreed to have their queries packaged and shipped to companies they have never heard of. The legal fiction of "anonymisation" cannot manufacture consent that was never given.
Behavioural search data is a goldmine for phishing, blackmail, social engineering, and corporate espionage.
Foreign intelligence services get a back door without effort. They do not need to breach Google. They only need to compromise the weakest name on the beneficiary list. One insolvent startup. One compromised contractor. One approved entity quietly acquired by a hostile state.
In the name of "competition," the EU is about to manufacture a permanent, distributed, daily-refreshed copy of Europe's collective search history. A surveillance dataset Brussels itself would never approve if any other government tried to build it.
The public consultation closes Friday, May 1, 2026 at 23:59 CEST. The final binding decision lands July 27, 2026.
After that, the door does not close again.
Tag your MEPs! File a response! Make noise!
The scope is staggering:
🔴 Every query you type
🔴 Every voice and photo search
🔴 Every autocomplete you accept
🔴 Your language, your device
🔴 Your country pinned to a ~3km² grid
🔴 Every result you saw, every link you hovered
🔴 Every click and scroll
🔴 The full chronological order of your search sessions
Meaning the European Union now knows your:
🔴 Health symptoms
🔴 Pregnancy
🔴 Sexual orientation
🔴 Political views
🔴 Religious beliefs
🔴 Financial distress
🔴 Legal trouble
🔴 Addictions
🔴 Affairs
Under the proposed measures for DMA Article 6(11), Google would be ordered to ship the daily search behaviour of hundreds of millions of Europeans to multiple third parties through a daily API feed. Any approved "online search engine," AI chatbots included, would get five years of access.
The things people only ever type when they think no one is watching. All of it now scheduled to flow daily into an open-ended list of third parties scattered across the European Union.
Brussels promises "anonymisation." The reality is a thin technical veneer that has been broken in academic literature again and again for over a decade. Search behaviour is a fingerprint. Stripping a name does not change that.
Mass data leaks become inevitable. Every new beneficiary is a new attack surface, and every annual audit is a year of silent exposure between checks. The 2025 Discord vendor breach already showed how fast 70,000 government IDs can leak through a single weak link. Now imagine that link holding Europe's search history.
Surveillance without consent becomes the default. Hundreds of millions of EU citizens never agreed to have their queries packaged and shipped to companies they have never heard of. The legal fiction of "anonymisation" cannot manufacture consent that was never given.
Behavioural search data is a goldmine for phishing, blackmail, social engineering, and corporate espionage.
Foreign intelligence services get a back door without effort. They do not need to breach Google. They only need to compromise the weakest name on the beneficiary list. One insolvent startup. One compromised contractor. One approved entity quietly acquired by a hostile state.
In the name of "competition," the EU is about to manufacture a permanent, distributed, daily-refreshed copy of Europe's collective search history. A surveillance dataset Brussels itself would never approve if any other government tried to build it.
The public consultation closes Friday, May 1, 2026 at 23:59 CEST. The final binding decision lands July 27, 2026.
After that, the door does not close again.
Tag your MEPs! File a response! Make noise!
😱33❤8🤬3🔥2🤔2😍1🤣1
🚨 SaaS platform ClickUp, used by 85% of the Fortune 500, has been leaking customer emails through its homepage for at least 465 days, and counting.
ClickUp has a $4 billion valuation. They are SOC 2 Type 2, ISO 27001, ISO 27017, ISO 27018, ISO 42001, and PCI DSS certified. The fix takes about 90 seconds.
Security researcher
weezerOSINT noticed a hardcoded Split[.]io SDK token sitting in plain text inside ClickUp's production JavaScript bundle. The bundle loads before you log in. View source, copy key, send one unauthenticated GET request, and 4.5MB of ClickUp's internal configuration is exposed: 959 customer emails and 3,165 internal feature flags.
The customer list consists of Home Depot. Fortinet, who sells enterprise firewalls. Tenable, who makes Nessus, the vulnerability scanner half the industry runs on. Autodesk. Rakuten. Mayo Clinic. Permira. Akin Gump. A Microsoft contractor. 71 ClickUp employees. Government workers from Wyoming, Arkansas, North Carolina, Montana, Queensland, and New Zealand.
It gets worse, ClickUp has a flag named "enable-missing-authz-checks." It is active in production. It lists five ClickUp API endpoints the company itself documented as having no authorization. They wrote down their own holes in a config anyone with a browser can read.
At first disclosure, another flag carried a live ClickUp API token tied to Fairfax County Public Schools, one of the largest school districts in the US, serving 180,000 students. The token pulled 1,066 staff records, including Chief Financial Services data. ClickUp removed that one token. They never rotated the SDK key that exposed it.
While that report rotted, the same researcher found a second bug. ClickUp's webhook API has zero SSRF protection. Reported via HackerOne on April 8, 2026. Status: "New." 19 days, zero response.
The original report was filed by weezerOSINT on January 17, 2025 (!). The key is still live. The emails still drop with one GET. ClickUp has had 465 days to rotate a single token. Zero response...
The fix is one click in the Split[.]io dashboard... ClickUp still hasn't replied to the researcher.
Original post of the researcher: https://x.com/weezerOSINT/status/2048662702957134199?s=20
ClickUp has a $4 billion valuation. They are SOC 2 Type 2, ISO 27001, ISO 27017, ISO 27018, ISO 42001, and PCI DSS certified. The fix takes about 90 seconds.
Security researcher
weezerOSINT noticed a hardcoded Split[.]io SDK token sitting in plain text inside ClickUp's production JavaScript bundle. The bundle loads before you log in. View source, copy key, send one unauthenticated GET request, and 4.5MB of ClickUp's internal configuration is exposed: 959 customer emails and 3,165 internal feature flags.
The customer list consists of Home Depot. Fortinet, who sells enterprise firewalls. Tenable, who makes Nessus, the vulnerability scanner half the industry runs on. Autodesk. Rakuten. Mayo Clinic. Permira. Akin Gump. A Microsoft contractor. 71 ClickUp employees. Government workers from Wyoming, Arkansas, North Carolina, Montana, Queensland, and New Zealand.
It gets worse, ClickUp has a flag named "enable-missing-authz-checks." It is active in production. It lists five ClickUp API endpoints the company itself documented as having no authorization. They wrote down their own holes in a config anyone with a browser can read.
At first disclosure, another flag carried a live ClickUp API token tied to Fairfax County Public Schools, one of the largest school districts in the US, serving 180,000 students. The token pulled 1,066 staff records, including Chief Financial Services data. ClickUp removed that one token. They never rotated the SDK key that exposed it.
While that report rotted, the same researcher found a second bug. ClickUp's webhook API has zero SSRF protection. Reported via HackerOne on April 8, 2026. Status: "New." 19 days, zero response.
The original report was filed by weezerOSINT on January 17, 2025 (!). The key is still live. The emails still drop with one GET. ClickUp has had 465 days to rotate a single token. Zero response...
The fix is one click in the Split[.]io dashboard... ClickUp still hasn't replied to the researcher.
Original post of the researcher: https://x.com/weezerOSINT/status/2048662702957134199?s=20
🤣17❤5😱3
‼️ The arrogance of the official French Ministry for Europe and Foreign Affairs account is beyond comprehension, something you'd only expect from the Russian MFA.
Ridiculing a just concern about the European Commission's proposal that puts millions of Europeans at risk. The 'French Response' account was launched to fight disinformation, instead it is now mocking citizens for reading the Commission's own published documents...
Ridiculing a just concern about the European Commission's proposal that puts millions of Europeans at risk. The 'French Response' account was launched to fight disinformation, instead it is now mocking citizens for reading the Commission's own published documents...
🤬18🤣3😭3😁2🤪2❤1
‼️🚨 BREAKING: Wiz got access to millions of GitHub repositories across users and organizations using one git push.
CVE-2026-3854: git push -o options injected into an internal header split by semicolons, parsed last-write-wins.
GitHub patched production in 6 hours.
Wiz published an article detailing what they've done: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
CVE-2026-3854: git push -o options injected into an internal header split by semicolons, parsed last-write-wins.
GitHub patched production in 6 hours.
Wiz published an article detailing what they've done: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
😱7❤2🤣1
‼️🇬🇷 Greece is moving toward a total ban on anonymous accounts on social media. Every post, every reply, tied to a verified legal identity.
Greece's Digital Governance Minister Dimitris Papastergiou confirmed today that the plan is meant to fight "toxicity," "hoaxes," and "character assassinations."
Mister Papastergiou says modern "digital democracy" should be "inspired" by Ancient Greece, where citizens openly expressed their views.
He apparently forgot the parts of Ancient Greece involving secret ballots, ostracism shards, and pseudonymous political pamphlets. The Athenian Assembly invented anonymous voting precisely because public attribution is dangerous.
Source: https://www.euractiv.com/news/greece-to-ban-anonymity-on-social-media/
Greece's Digital Governance Minister Dimitris Papastergiou confirmed today that the plan is meant to fight "toxicity," "hoaxes," and "character assassinations."
Mister Papastergiou says modern "digital democracy" should be "inspired" by Ancient Greece, where citizens openly expressed their views.
He apparently forgot the parts of Ancient Greece involving secret ballots, ostracism shards, and pseudonymous political pamphlets. The Athenian Assembly invented anonymous voting precisely because public attribution is dangerous.
Source: https://www.euractiv.com/news/greece-to-ban-anonymity-on-social-media/
😭13💩9👏3🤣3😨3❤2🤬1
❗️🇺🇸🇮🇱 Intuit, the US tech giant behind TurboTax, lets employees wear IDF uniforms to work and take months off to fight Israel's wars.
Last month, Intuit data analyst Tom Yacobi joined an all-hands Zoom call in his full IDF uniform.
Roughly 100 million Americans use TurboTax.
Source: https://www.donotpanic.news/p/exclusive-the-us-tech-giant-where
Last month, Intuit data analyst Tom Yacobi joined an all-hands Zoom call in his full IDF uniform.
Roughly 100 million Americans use TurboTax.
Source: https://www.donotpanic.news/p/exclusive-the-us-tech-giant-where
😨20❤9🤬6💩4😭4🔥3😁1🙏1💯1
🚨🇪🇺 BREAKING: The European Commission just told all 27 member states to hurry up with rolling out online age verification, demanding deployment before the end of 2026.
Asked today how the system stops anyone bypassing it with a VPN from outside the EU, Vice-President Virkkunen said only that it is "an important part of the next steps."
Asked today how the system stops anyone bypassing it with a VPN from outside the EU, Vice-President Virkkunen said only that it is "an important part of the next steps."
🤬13💩9❤1
❗️🇩🇪 Germany says Signal is unsuitable for official communications. Members of the Bundestag have been formally urged to switch from Signal to Wire, after a Russian intelligence operation compromised the Signal account of Bundestag President Julia Klöckner.
The choice of Wire is also strategic.
Wire is a German company, headquartered in Berlin, operating under EU jurisdiction. The German federal cybersecurity agency BSI has approved Wire Bund for the exchange of classified information up to VS-NfD ("Restricted, For Official Use Only"). The platform is GDPR-compliant, NIS2-aligned, and self-hostable on European infrastructure.
Signal, by contrast, is a US-based non-profit subject to the US CLOUD Act. The CLOUD Act allows American authorities to compel data access from US-headquartered providers regardless of where the data is physically stored. For a European parliament communicating about defence, foreign policy, or intelligence cooperation, that is a structural problem before you even reach the phishing question.
Two operational reasons Wire is harder to phish:
🔴 Registration uses an email address, not a phone number
🔴 The email address is not visible to third parties
Signal binds accounts to phone numbers. Anyone who knows your number can attempt to contact you, and enterprise controls like Single Sign-On are difficult to apply.
The push is not new. Bundestag Vice-President Andrea Lindholz previously called for the same migration and proposed an outright ban on Signal for official parliamentary devices.
Important context. This is not a vulnerability in Signal's encryption protocol. The Signal protocol remains the gold standard for end-to-end encryption. The attacks succeed at the human and account-recovery layer, the layer Signal's phone-number-based identity model exposes by design.
The Bundestag move fits a much larger European pattern. Brussels is pushing GAIA-X for sovereign cloud, the EUDI Wallet for digital identity, and now Wire for parliamentary communications. The throughline is the same: reduce dependence on US-headquartered infrastructure, especially for anything touching classified or politically sensitive data.
Germany is now the highest-profile government to formally treat Signal as unsuitable for official communications. The replacement is European. Other EU members will be watching as Germany takes the lead.
The choice of Wire is also strategic.
Wire is a German company, headquartered in Berlin, operating under EU jurisdiction. The German federal cybersecurity agency BSI has approved Wire Bund for the exchange of classified information up to VS-NfD ("Restricted, For Official Use Only"). The platform is GDPR-compliant, NIS2-aligned, and self-hostable on European infrastructure.
Signal, by contrast, is a US-based non-profit subject to the US CLOUD Act. The CLOUD Act allows American authorities to compel data access from US-headquartered providers regardless of where the data is physically stored. For a European parliament communicating about defence, foreign policy, or intelligence cooperation, that is a structural problem before you even reach the phishing question.
Two operational reasons Wire is harder to phish:
🔴 Registration uses an email address, not a phone number
🔴 The email address is not visible to third parties
Signal binds accounts to phone numbers. Anyone who knows your number can attempt to contact you, and enterprise controls like Single Sign-On are difficult to apply.
The push is not new. Bundestag Vice-President Andrea Lindholz previously called for the same migration and proposed an outright ban on Signal for official parliamentary devices.
Important context. This is not a vulnerability in Signal's encryption protocol. The Signal protocol remains the gold standard for end-to-end encryption. The attacks succeed at the human and account-recovery layer, the layer Signal's phone-number-based identity model exposes by design.
The Bundestag move fits a much larger European pattern. Brussels is pushing GAIA-X for sovereign cloud, the EUDI Wallet for digital identity, and now Wire for parliamentary communications. The throughline is the same: reduce dependence on US-headquartered infrastructure, especially for anything touching classified or politically sensitive data.
Germany is now the highest-profile government to formally treat Signal as unsuitable for official communications. The replacement is European. Other EU members will be watching as Germany takes the lead.
😁8❤3🔥1