from the ctrl-alt-speech dept

Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw.

Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed. To get extended episodes with additional coverage, support us on Patreon.

In this week’s roundup of the latest news in online speech, content moderation and internet regulation, Ben is joined by Niklas Eder, co-founder and co-CEO of User Rights, a designated out of court dispute settlement body under the Digital Services Act which reviews complaints from users whose social media posts have been deleted or moderated. Together, Ben and Niklas discuss:

And in the extended episode for Patreon supporters, they cover:

Our fun links this week are a lawn mowing game for post-World Cup stress relief and the Center for the Alignment of AI Alignment Centers because we need more satire right now. 

This episode is sponsored by PwC, whose upcoming 2026 Trust and Safety Outlook Report explores the forces reshaping how organizations are approaching online safety and integrity. In our special bonus chat, Ben sits down with Dan Hays, Principal Partner of Strategy& (part of the PwC network), to talk about the future of trust and safety and get a sneak peek at some of the themes in their report before its release next week at TrustCon.

If you’re already a Patreon supporter, you can get the extended episode on Patreon.

Filed Under: child safety, content moderation, eu, immigration, social media, trust and safety, uk

Companies: discord, meta

Residential proxies are no longer treated as a simple anonymity tool in carding circles. They are increasingly discussed as one component of a broader identity-simulation stack, alongside device fingerprints, browser profiles, billing information, time zones, cookies, and transaction behavior.

To better understand how criminal actors currently use and evaluate this infrastructure, Flare researchers analyzed 2,889 unique underground posts published in the past two years across approximately 545 discussion threads. The conversations include operational guides, troubleshooting requests, provider comparisons, transaction-failure discussions, and advertisements for supposedly “clean” or finance-compatible proxy services. 

Together, they show that residential IP addresses remain important to carders but are no longer viewed as a reliable bypass on their own. Instead, actors repeatedly describe a market in which proxy pools become overused, addresses accumulate poor reputations, location data is inaccurate, and financial services block entire ranges. As a result, carders are becoming more selective, attempting to match IP geography with stolen identity data while combining proxies with antidetect browsers and other techniques designed to create a convincing digital identity.

The findings suggest that residential proxies remain a key part of the carding ecosystem, but also one of its increasingly fragile components.

Key points

• Carders increasingly judge a proxy by its history, not merely whether it belongs to a residential internet provider.

• Geographic consistency now extends beyond country matching to city, ZIP code, time zone, browser language, and billing information.

• Residential IPs are rarely considered sufficient alone and are frequently paired with antidetect browsers and fingerprint manipulation.

Advertisement

• Provider restrictions are creating a secondary market for supposedly “clean” residential IPs capable of reaching financial services.

• Defenders should treat residential traffic as context—not evidence that a user is legitimate.

What are residential proxies?

A residential proxy routes traffic through an IP address assigned by an internet service provider to a household or consumer device.

To a website, the connection may resemble that of an ordinary home user rather than traffic originating from a hosting provider or commercial VPN.

Residential proxies have legitimate uses, including localization testing, advertising verification, and brand protection.  Criminal actors value them because they can make fraudulent sessions appear closer to normal consumer traffic.

“Clean” has replaced “residential”

One of the clearest findings from the dataset is that carders no longer speak about residential proxies as a single trusted category. Instead, they divide them into “clean” and “dirty” pools.

A widely reposted underground guide titled “Getting the Cleanest Possible IPs for Carding” (see screenshot below) argues that even residential pools deteriorate as addresses are repeatedly used for abuse.

Another guide claimed that the important question was not simply whether an IP was residential, but whether it had previously been used against banks, payment processors, or other fraud-sensitive services.

This thinking also appears in troubleshooting discussions. Users compare fraud-score services, complain that the same address receives dramatically different reputational ratings, and report that an IP initially considered clean can become high-risk after a short period of activity.

The underlying assumption is significant: carders increasingly believe that proxy reputation is dynamic and influenced by every other customer using the same infrastructure.

Precision is moving from country to identity consistency

Older carding advice is often focused on selecting an IP in the same country as the stolen card. Recent posts describe a far narrower standard. 

A January 2026 thread about “geoconsistency” (see screenshot below) discussed matching an IP’s approximate location with the billing ZIP code, device time zone, operating-system language, and browser characteristics.

In another discussion, a user complained that major residential-proxy providers had removed ZIP-code targeting and now offered only country, state, and city selection.

The actor feared that city-level targeting would no longer provide enough precision to avoid fraud controls.

Not every technical claim made in underground forums is necessarily accurate. However, the discussions clearly demonstrate the actors’ operational mindset: they are trying to construct a coherent digital identity rather than merely concealing their real IP address.

The proxy is only one layer

The dataset repeatedly connects residential proxies with antidetection browsers, isolated devices, cookie history, WebRTC configuration, Canvas and WebGL fingerprints, and user-agent consistency.

One April 2026 guide warned that a “perfect residential proxy” would still fail if the browser profile exposed contradictory information. Another setup guide argued that copying a fixed configuration was ineffective because the device, proxy, account history, payment information, and target merchant must all be evaluated together.

This reflects the direction of modern fraud detection. Stripe’s documentation describes controls that combine transaction, identity, card, and historical signals rather than relying on one indicator. Its guidance on card testing also highlights velocity, repeated declines, inconsistent billing information, and the reuse of cards or customer details.

Carders are searching for finance-compatible IPs

Several posts complain that established proxy providers restrict access to banks, payment processors, government portals, and other fraud-sensitive services. This creates a practical problem for carders: an IP may appear residential and have a low fraud score yet still be unusable against the intended target.

Some actors interpret these restrictions as a sign that the provider is protecting its address pool from abuse. One widely circulated guide even suggested that restricted residential pools may contain cleaner IPs precisely because they have not been repeatedly used against financial institutions.

At the same time, the restrictions are creating demand for services advertised as “finance enabled,” “bank compatible,” or capable of accessing specific payment platforms.

Underground users exchange provider recommendations and methods for testing connectivity, although the reliability of these advertisements is difficult to verify and some may be scams.

This search for usable residential infrastructure is taking place within a much larger and increasingly contested proxy ecosystem. In July 2026, the FBI and industry partners seized hundreds of domains associated with the NetNut residential proxy platform and the Popa botnet.

Researchers connected the network to at least two million compromised devices, including smart TVs and streaming boxes, which were converted into residential proxy nodes.

The infrastructure was reportedly used for activities including advertising fraud, account takeover, and other abusive traffic.

A March 2026 FBI alert further warned that criminals can select residential proxy addresses down to the state and city level and specifically cited their use for account takeover, including matching an IP address to the victim’s city to reduce the likelihood of triggering a bank’s geolocation controls.

Together, the underground discussions and recent disruptions show why carders increasingly distinguish between merely obtaining a residential address and obtaining one that is sufficiently clean, precisely located, and permitted to interact with financial services.

What defenders can take

Residential IP addresses should not be treated as inherently trustworthy. The stronger signal is consistency across the entire session: device history, account age, browser fingerprint, payment instrument, billing information, transaction velocity, and behavior after checkout.

Organizations should also look for patterns that proxies do not easily conceal, including repeated identity creation, multiple cards connected to similar devices, abrupt geography changes, mismatched time zones, and clusters of low-value authorization attempts.

The underground discussions suggest that defenders are already raising the cost of fraud. Carders are spending more time searching for uncontaminated infrastructure, debating conflicting reputation scores, and trying to align increasingly granular identity signals.

Residential proxies remain valuable to carders, but they are no longer a universal bypass. Their effectiveness increasingly depends on the credibility of everything surrounding them and that broader identity is a much harder challenge for cybercriminals.

Learn more by signing up for our free trial.

Sponsored and written by Flare.

Google warns that new legal orders could put EU users’ privacy at risk.

The European Union is ordering Google to level the playing field for its competitors on two fronts in the latest attempt to curtail Big Tech dominance within the bloc.

A ruling from the European Commission means competitors must be given the same level of access to features on the Android operating system as Google enjoys in order to ensure that their AI services can compete with the likes of Gemini.

A second order asks the tech giant to offer third-party search engines access to search data that only Google can collect given its scale and reach.

The company has until January 2027 to begin sharing its search data, and until July 2027 to open up Android to competing AI providers.

These orders result from EU proceedings that try to detail how the bloc’s strict Digital Markets Act (DMA) rules should be implemented for proper compliance. The Commission began these particular deliberations in January.

In its decision yesterday (16 July), the EU argued that competing AI assistants on Android devices have restricted access to the operating system’s functionalities. Without full access, third-party providers are limited in how they offer their services, making them less attractive to 60pc of Android users in the bloc, the Commission said.

The order, the EU said, would ensure users can activate their preferred AI assistant via voice commands comparable to ‘Hey Google’ and use third-party AI agents on Android devices.

The Commission also wants Google to share anonymised search data with competing search engines – data that it would currently use to optimise its own services.

“[Google] was removing between 90pc and 100pc of unique search queries from the dataset” it had previously shared as part of a DMA compliance proposal, the EU said.

“It was also unduly restricting the potential pool of beneficiaries by excluding AI chatbots that provide search services. As a result, there has been no meaningful uptake by potential beneficiaries.”

Google, however, will maintain the right to assess privacy and security risks before sharing any data.

Kent Walker, Google and Alphabet’s president of global affairs, said that the orders “risk undermining vital privacy and security guardrails for millions of Europeans”.

“We have repeatedly offered solutions to safeguard users while satisfying the DMA’s goals, but these rulings discount extensive evidence of user harm.”

Walker argued that third-party AI assistants can already “safely” access Android functionalities. Phone manufacturers play a key role in vetting eligible AI providers, he added, and suggested the ruling “threatens device security by granting external apps sensitive and powerful device permissions without these safeguards”.

The latest ruling comes just as the EU is expected to hand the tech giant a major penalty over breaching the DMA with its tactics around search ranking and its app marketplace Google Play.

German publication Handelsblatt reported in May that the expected high triple-digit-million-euro penalty could be the highest fine imposed under the DMA since its enactment in 2022.

So far, Apple and Meta are the only companies to be penalised under the law, with Apple receiving a €500m fine last year – the highest penalty yet.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Updated, 2:31pm, 17 July 2026: This article has been updated with background information in the final three paragraphs.

If you look at the AI landscape, a majority of its usage in the film and television industry has been pretty controversial. Bringing dead actors to life on a screen, using AI to record vintage songs that were never completed, or just using it to film scenes or handle any other part of the creative process — the backlash has been pretty vocal. But there are a few slivers of hopeful AI usage, too, and Google just delivered one of those in a heartwarming fashion using Gemini AI.

I wonder the world never archived

This is how the story goes. In 1959, Brazilian football legend Pele scored a goal. And in his own words, it was the best goal of his career. The “Black Pearl” pulled off three consecutive sombreros past the defenders, performed a knee flick past the goalkeeper, and then headed the ball into the net. Getting past multiple opponents, without the ball ever touching the ground, and finishing it off without a perfect header. It’s something you rarely ever see, even at the highest levels of professional football. The problem? It was never filmed.

The “Gol da Rua Javari” was only witnessed by the thousand of fans and other players on the pitch, only a handful of whom are still alive. The only archival memory was an old photogaraph of the header moment. Google’s team conducted interviews with people how saw the even in person, some six decades, and pieced together Pele’s steps. Then, using photographs of the stadium, fans, and other players on the ground, a vision was developed of how the events unfolded.

Next, Google’s team recreated the whole scene with real humans in the same stadium where Pele scored the goal. For accuracy, they even created the heavy leather ball from that era, alongside Pele’s dark boots, and even the uniforms. The whole act was mapped, somewhat like motion capture in films, but without any of the specialized dresses and gear involved.

The whole foundation was fed into a system, and using Gemini Omni, Nano Banana Pro image generator, and the Google Veo video engine, the captured data was restyled and given a vintage look resembling the old photographs. Characters were replaced (the stunt person wearing the iconic No. 10 jersey was swapped with Pele’s digital likeness) and the whole stadium from that fateful match in 1959 was recreated.

A feat reanimated from the pages of history

“To ensure the generations looked as period accurate as possible, we ran the digital output through a filmout machine, capturing the distinct look and feel of 1950s cinema,” Google writes in its blog. It was a lot of work. But the end result is simply stunning. Seeing Pele’s legendary goal for the first time in action, the sheer ball skill, and on-field mastery come to life on video is a sight to behold.

The fact that it happened with the consent of Pele’s family, and with support from footballers, fans, and real historians, is something that seprates it from your usual cash-grab AI deployment. ““He would be so proud to see all this happening. He’d always say it was a shame that the goal was never recorded. So being able to relive it, with all this technology, is amazing.” Pele’s daughter was quoated as saying.

Apple and the US Department of Justice are in early discussions about settling the 2024 antitrust lawsuit that alleges Apple violated competition law through its iPhone ecosystem, Bloomberg reported on Thursday. Apple has made multiple offers this year to close the case. The discussions are active but there is no guarantee of an agreement, and no trial date has been set.

The DOJ sued Apple under the Biden administration alongside 19 states and the District of Columbia. The complaint alleged Apple blocked super apps, discouraged outside messaging solutions and cloud streaming apps, restricted rival digital wallets, and hindered smartwatch competition. Apple lost a bid to dismiss the case in June 2025. Apple is already dealing with the Supreme Court’s refusal to pause its contempt order in the Epic case, making a DOJ settlement all the more attractive to reduce its legal exposure.

Apple has already addressed several of the original complaints. It launched a mini apps programme, opened Messages to the RCS standard led by Google, allowed cloud-streaming apps, and opened the iPhone’s NFC payment chip to third-party apps. The Apple Watch still does not work with Android, but Apple has improved compatibility with non-Apple watches on the iPhone.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

The Trump administration’s DOJ is pushing to settle antitrust cases inherited from the Biden era. Stanley Woodward, the No. 3 DOJ official overseeing antitrust, views settlements as a way to save taxpayer money and deliver faster consumer relief than multi-year litigation. Whether the 19 state attorneys general are part of the settlement talks is unknown. Regulators globally are pressing Apple to open its platforms, and a DOJ settlement could set the template for how much Apple concedes before its other cases reach trial.

Gaming is better with great gear. A powerful gaming headset and a good keyboard are two must-haves for me, whether I’m playing Stardew Valley or firing up my latest unfinished run of Baldur’s Gate 3 (I’ll move on eventually to Expedition 33, I promise). A longtime favorite brand of WIRED’s for this kind of gaming gadgetry comes from SteelSeries. SteelSeries’ latest gaming headphones and mice have been a hit in testing, and now you can score your very own with the help of a SteelSeries discount code.

Whether you’re shopping for a new gaming headset or keyboard, or looking for a discount on your first order, a SteelSeries coupon code can get you deals on just about anything SteelSeries offers. Here’s where to find the SteelSeries promo codes to save.

SteelSeries Coupon Codes: 15% Off Gaming Headsets

It’s not a great gaming setup if you don’t have a headset to let you immerse yourself into the game. Most of my favorite games stay longtime favorites thanks to their soundtrack, after all, and gaming headsets are also designed to let you both join a Discord call without muting the game’s music. Both the SteelSeries Arctis Nova Elite and Arctis Nova 3P Wireless were recent hits with our reviewers, and now you can use the SteelSeries promo code POWERUP15 for 15% off gaming headsets.

10% Off With a SteelSeries Coupon for First Orders

Making your first order ever from SteelSteries? There’s a discount code for that. The SteelSeries first order coupon code lets you take 10% off your first full-price purchase as a new customer. To use it, skip the sale section, and pick anything else at full price that catches your eye on SteelSeries’ site. It’s a great way to splurge without totally splurging on things like gaming mice and controllers that might not already be on sale.

Get the Latest SteelSeries Deals and Offers

If you’re curious about what’s already on sale without needing a SteelSeries coupon code, check out the SteelSeries deals section. You’ll find headsets, keyboards, controllers, mice and more already on sale, with discounts often up to 30% or more. It’s a great spot to shop if you’re not picky about what you want, and there’s several colors of the Arctis Nova 3P Wireless you can find for sale right now.

Up to 39% Off SteelSeries Bundles

If you know you want a little of everything—a keyboard! A headset! A controller!—then you should look at a SteelSeries bundle to get a better deal. You won’t need a formal SteelSeries coupon code for these, and can instead head to the gaming bundles section of SteelSeries’ site to get up to 39% off bundles of gaming gear. I’m personally a sucker for the White Out Core Bundle that’s 22% off, but there’s tons of bundles that vary for what you might be looking for.

SteelSeries Promos: 30% Off Gaming Controllers

There’s no gaming without a gaming controller for me, at least where most games are involved. Sure, I want a keyboard handy when needed, but I find it infinitely more comfortable to use a controller instead of the keyboard shortcuts to walk around (not everyone feels that way, so you do you.) If you need a new controller, SteelSeries has you covered with discounted gaming controllers on its site. It’s another category you don’t need a formal code for, and instead can just shop around the gaming controllers section to get up to 30% off.

Get 29% Off SteelSeries Keyboards

Finally, gaming keyboards are also discounted, with no SteelSeries promo code required. Our reviewers liked the SteelSeries Apex Pro, and there’s a ton of colorways and versions of that very keyboard already on sale for you to shop on SteelSeries keyboard section. The discounts go as high as 29% off, but not every option is on sale, so choose wisely.

from the if-only-that-mattered dept

I don’t think it’s terribly controversial to say that this second Trump administration has never shown much concern for the Hatch Act. If you’re not familiar with that particular law, it makes it illegal for most of the members of the executive branch of the federal government, and some state representatives, to engage in partisan political activity. Sometimes the question of whether something violates the Hatch Act can be tricky, or a matter of interpretation.

And sometimes RFK Jr. rides in to provide a nakedly blatant example of a Hatch Act violation. Ron Wyden is calling for an investigation into Kennedy after he reportedly called two different Libertarian candidates in Iowa running for congressional seats to suggest that they drop out. This could be otherwise described as election interference in violation of the Hatch Act.

Wyden cited two instances in which Kennedy may have violated the Hatch Act by encouraging two Libertarian candidates in Iowa to drop out of their respective races.

In a phone call to Libertarian House candidate Marco Battaglia of Iowa’s 3rd Congressional District, Kennedy reportedly said, “If this seat flips, it’ll make my life hell.”

In a phone call to Rick Stewart, another Libertarian House candidate running to represent Iowa’s 2nd Congressional District, Kennedy reportedly suggested Stewart could find another position within federal government but outside elected office, adding that he would help him accomplish this.

Advertisement

Kennedy is doing this because both races are reportedly quite close and pretty much everyone agrees that the only real impact these Libertarian candidates would have on the election is pulling a few percentage points of the vote away from the Republican candidates. Plainly partisan political influence on an upcoming election, in other words, with something pretty close to bribery to boot when it comes to offering other positions within government in exchange for dropping out.

“Secretary Kennedy called Stewart in his official capacity as a member of the President’s cabinet, and he asked that Stewart suspend his campaign in order to make it easier for the Republican candidate to win the race, easier for the Republican Party to maintain its majority in the House of Representatives, and easier for Kennedy to personally avoid Congressional subpoenas from Democratic committee chairs,” Wyden wrote in his letter to Greer.

“Iowa’s voters should be able to freely choose who represents them in Congress, and our democracy does not allow political appointees to take that power away from them by deleting candidates from the ballot.”

I don’t really know how to argue with any of that. I also don’t have any problem believing that Kennedy has no idea what the Hatch Act is or says, nor that he was violating any laws in making these phone calls. But if the reports are correct, it appears he did. And I also don’t doubt that further reporting will reveal more of Kennedy doing this sort of thing.

That’s the problem with having unprofessional clowns working in your administration.

Filed Under: election interference, hatch act, iowa, marco battaglia, rfk jr., rick stewart, ron wyden

Festivals pose a bit of a conundrum when it comes to charging. It’s really useful to have a phone — for checking programs, finding friends, and snapping photos — but the days are long, and there’s minimal access to power points. A power pack is your best friend, and below I’ve rounded up the best models for festival-goers.

I’ve included a mix of options. There are compact, lightweight power banks that won’t weigh your bag down and can charge your phone while you’re using it. These can generally only manage two charges at the absolute maximum, so they’re best suited to one- or two-day festivals, or festivals where you’ll have overnight access to power. There are also larger power packs that offer multiple recharges, but which are generally too bulky and heavy to carry around all day.

Rewind just a few years and the All Blacks vs Ireland was the foremost fixture in rugby. Although they’ve each won both of their Nations Championship 2026 games so far, neither side has convinced – and against lesser opponents to boot. Saturday’s clash in Auckland, therefore, feels like an opportunity to silence some doubters.

New Zealand narrowly avoided an embarrassing defeat to France’s reserves in their opener, before a comprehensive albeit ragged victory over Italy, while Ireland scraped past a crisis-stricken Australia before being pushed hard by Japan.