from the two-sides-to-every-schwartz dept

There’s a lot of health news going on in the country right now, in no small part to the absolutely pitiful and pathetic job RFK Jr. is doing heading up HHS. It is a near certainty that by the end of this week, the CDC will have published an updated case count for measles that is greater than last year’s total case count, which was itself the largest since the 90s. Pertussis is also surging. There’s that new outbreak going around where you apparently just shit your pants constantly, like some kind of minor South Park character or something.

And so it was something of a breath of fresh air when the Trump administration nominated Erica Schwartz to lead the CDC, all because she appeared to be well qualified for the role and hadn’t said anything crazy-pants about things like vaccines. That this has become the standard for a feel-good HHS story is telling, but it was welcome news all the same.

Commenting on the nomination, Kennedy said he wouldn’t commit to taking CDC advice on vaccines, nor would he commit to not directly interfering with CDC operations and policy making.

Kennedy’s response Tuesday suggested Schwartz could face an equally short tenure. His answer came amid an exchange with Rep. Raul Ruiz (D-Calif.) in a hearing of the House Committee on Energy and Commerce. Ruiz asked Kennedy: “If Dr. Schwartz is confirmed, will you commit on the record today to implement whatever vaccine guidance she issues without interference?”

Kennedy replied without hesitation: “I’m not going to make that kind of commitment.”

Advertisement

Which is part of what informed senators to ask Schwartz about resisting Kennedy’s fuckery in her confirmation hearings. Sadly, it appears that Schwartz refused to demonstrate that she in fact has a backbone.

[D]uring a hearing sometimes marked by heated exchanges, Dr. Erica Schwartz repeatedly declined to say whether she would resist political pressure from Health Secretary Robert F. Kennedy Jr. over vaccine policy.

Committee Chairman Bill Cassidy, R-La., repeatedly questioned Schwartz about whether she would have authority to make personnel and policy decisions without political interference from the Health and Human Services Department. Schwartz did not directly answer whether she could hire and dismiss CDC employees independently or whether she would refuse directives from Kennedy that conflicted with scientific evidence.

Asked by Sen. Maggie Hassan, D-N.H., whether she would carry out an order to discontinue a public campaign encouraging influenza vaccination, Schwartz replied, “I don’t speak in hypotheticals.”

And so, once again, the country will get to wonder whether the CDC really does have an actual director, or just some figurehead placed there to give Kennedy’s insanity the veneer of consensus. This is a very real problem given our current context and, frankly, these questions should not be terribly difficult to answer. For someone with integrity, at least, the answer should be something like, “As CDC’s Director, it would be my responsibility to refuse any order that would make the country less healthy, no matter who it comes from. And as CDC Director, I would have that authority by the nature of the position.”

All of that being said, Schwartz did at least reaffirm her sanity on the topic of vaccines.

Ranking Member Sen. Bernie Sanders, I-Vt., asked Schwartz if she would remove a webpage updated last November on the CDC’s website on autism and vaccines. The webpage states that a link between the two has been ignored despite many studies finding no such link.

Schwartz said she accepted there is “overwhelming evidence” vaccines don’t cause autism, but did not commit to removing the webpage.

“Senator, I have been in situations where I have had to go to my superiors in the military to have conversations, very difficult conversations, about things that may have been concerning to the troops or to the military personnel, and I will do the same with [Secretary Robert F. Kennedy Jr.],” she replied.

Once again, great that she is sane when it comes to vaccines, less great that she won’t commit to actually doing the right thing and removing the nonsense from CDC’s website.

I’m still relatively optimistic about Schwartz leading CDC. It may be that she didn’t want to publicly embarrass what would be her new boss if confirmed. It may be that she ends up pushing back hard on Kennedy’s attempts at interfering with her agency if confirmed, which will probably end up with her being fired. Even that would be fine by me, since it would be one more glaring data point of chaos at HHS under Kennedy.

If that led to Kennedy’s firing, it would be worth it.

Filed Under: autism, cdc, erica schwartz, health & human services, rfk jr., vaccines

A proposed class action is trying to turn Apple’s unresolved Hide My Email flaw into a nationwide payout without alleging that the vulnerability was used in an attack or that the plaintiff’s email address was exposed.

Anthony Alvarez filed the lawsuit against Apple on July 15 in the U.S. District Court for the Northern District of California. The complaint accuses the company of false advertising, fraud, breach of contract, and other violations tied to its marketing of Hide My Email.

The filing argues that Apple sold customers privacy it couldn’t provide. The claims cover the full version included with paid iCloud+ plans and the more limited relay addresses generated through Sign in with Apple.

Alvarez seeks to represent four proposed classes covering U.S. Apple customers, including two California subclasses. The lawsuit seeks damages and an order requiring Apple to fix Hide My Email or clearly disclose its limitations.

The allegations haven’t been tested in court, and no class has been certified.

A real flaw, but no alleged attack

Security researcher Tyler Murphy discovered the flaw and reported it to Apple in June 2025. The vulnerability became public on July 1 after the problem remained unresolved for more than a year.

Apple said in March 2026 that a system change had addressed the issue, but Murphy’s testing showed that the vulnerability remained. Apple later told Murphy that it planned to address the problem through a future security update.

404 Media independently confirmed on June 29 that the vulnerability could connect a Hide My Email relay address with the real email account behind it. The publication withheld the technical details because the flaw could still be exploited.

Apple deserves criticism for apparently leaving the problem unresolved while continuing to advertise Hide My Email as a privacy feature included with iCloud+. A feature designed to conceal a personal address loses much of its value when another person can trace the relay address back to the account behind it.

However, neither the complaint nor the public reports identify a known malicious attack using the flaw. Alvarez doesn’t allege that anyone uncovered or misused his email address, sent him unwanted messages, or otherwise exploited the vulnerability against him.

Alvarez’s claimed injury is financial. The complaint says he bought an iPhone and subscribed to the 200GB iCloud+ tier on or around March 15, 2025, and that he wouldn’t have paid as much had he known Hide My Email could fail.

The lawsuit extends that overpayment theory to four proposed classes, including people who bought Apple hardware and used the bundled version through Sign in with Apple.

A narrow flaw becomes a sweeping damages claim

The iCloud+ theory is relatively straightforward because Apple explicitly includes Hide My Email with a paid subscription. Customers paying for that subscription can expect the feature to perform the function Apple advertises.

The hardware claim is more ambitious. The complaint, first reported by MacRumors, tries to attribute part of an iPhone or Mac‘s price to Hide My Email without explaining what the feature was worth or how a court could separate that value from everything else included with the device.

Apple markets privacy as a reason to choose its products, so a prominent privacy failure can damage customer trust even without a documented attack. However, the Hide My Email flaw doesn’t automatically prove that every affected customer overpaid for an entire Apple device.

The lawsuit arrived 14 days after the vulnerability became public. The broad proposed classes and the absence of any alleged attack against Alvarez make the case look like ambulance chasing.

Apple mishandled a real privacy flaw, and customers shouldn’t have to wait for an attack before the company fixes it. Still, the lawsuit looks more like an attempt to monetize a newly publicized risk than compensation for proven misuse.

In 1675, while transporting a barometer by night, the astronomer Jean Picard noticed a glow inside its glass tube, just above the mercury. As the mercury sloshed and splashed across the surface of the glass, a static electric charge had built up, which was discharging by ionizing the residual gas molecules inside the evacuated tube. [Styropyro] recreated this effect, and found that the dim glow could be made much stronger by adding some noble gas to the tube.

It starts with a simple recreation: he took a volumetric flask, attached a narrow glass stem to the mouth, added some mercury to the flask, evacuated it with a vacuum pump, and sealed off the glass stem. This produced a faint glow when shaken, but it was only really visible under very low light. When [Styropyro] brought it near a Tesla coil, however, it did glow much more brightly.

Backfilling an identical flask with neon to about 40 millitorr produced a much more spectacular result (a low pressure in the tube is necessary, but moderate pressure variations don’t significantly alter the effect). When shaken even slightly, this neon-containing flask produced a bright orange-red glow just above the surface of the mercury. Points of obstruction, such as those in a zig-zag tube, produced a brighter glow. A krypton-containing tube glowed blue, but less brightly than the neon tube.

Since this is, essentially, a triboelectric effect, other materials besides mercury should work; [Styropyro] tested several materials, and found that pieces of Teflon produced a faint glow, and copper beads a somewhat brighter glow. Unfortunately, Galinstan, the obvious replacement for mercury, wets and coats glass, preventing a charge buildup.

Without an added noble gas, the standard glow of barometric light comes from the excitation of mercury vapors, a glow which can also be seen in mercury rectifiers, and which excites the phosphors of fluorescent light bulbs.

Thanks to [Vik Olliver] for the tip!

It’s a mammoth task to bring a beloved IP like Heartstopper to a close, but creator Alice Oseman has done an incredible job with the new Netflix movie, Heartstopper Forever.

If you’re bummed out because we’re not getting a full fourth season, don’t be. As Nick (Kit Connor), Charlie (Joe Locke), and the gang all brace before going their separate ways to university, a feature film actually reflects their growing maturity and crises of confidence much more fittingly.

A new macOS information-stealing malware dubbed ClickLock terminates all visible processes to force users into entering their system login password.

The malware is designed to steal cryptocurrency assets, login credentials, password-manager data, browser information, and macOS authentication data, and it can also install a persistent backdoor for ongoing remote access to infected systems.

Researchers at Group-IB analyzed the ClickLock shell script after discovering the malware on VirusTotal, where it was first submitted on June 9. At the time of the report, it remained undetected by all security vendors available on the platform.

Further investigation revealed that the malicious script has infected at least 100 systems across 33 countries since May.

The compromise likely begins via a ClickFix lure, as the researchers observed pastes of a malicious command in the Terminal that trigger a fake Cloudflare “human verification” sequence with an animated progress bar.

At the same time, keyboard interrupts are disabled, the terminal cursor is hidden, and the stealer modules are downloaded in the background.

The macOS NotificationCenter is also suppressed for about six hours, effectively disabling notifications that could expose the attack.

Forcing password entry

Group-IB researchers highlight that ClickLock does not require any exploits or elevated privileges but achieves its goal through social engineering and forced interaction loops.

Operational success is obtained through the malware’s mechanism for coercing the victims into entering their macOS system password.

Group-IB says that the script initially displays a fake macOS password dialog using the victim’s real username and a downloaded Apple icon.

If the user enters their password, the malware validates the data and exfiltrates it to the attacker via Telegram.

In case the user cancels the dialog, the malware establishes persistence via two macOS LaunchAgents (com.authirity.plist, com.chromer.plist) and reloads at the next login.

At the next activation, the password-stealing module runs a termination loop every 210 milliseconds, targeting key apps (e.g., Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, web browsers) and shows only a password dialog on the screen until the victim complies.

Group-IB reports that the loop is configured to continue for 300,000 seconds (about 83 hours), or until the victim supplies a correct password.

The second LaunchAgent runs a separate coercion mechanism that also terminates many of the mentioned system applications, requesting Keychain authorization via a legitimate system prompt, seeking approval to access Chrome’s Safe Storage key.

That key could then be used to decrypt offline Chromium-stored passwords, cookies, and autofill information from stolen databases.

This second mechanism has a repeat interval of 200 milliseconds and is configured to last for nearly 35 days (3 million seconds).

ClickLock also deploys a data-harvesting module, which targets the following:

• Data from eight browsers: Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Chromium
• Saved logins, cookies, autofill data, bookmarks, local storage, and session storage
• Cryptocurrency wallet extensions and desktop wallet files
• Encrypted wallet vault material for potential offline cracking
• Password-manager extension data
• Cached cryptocurrency addresses across EVM, Bitcoin, Solana, TRON, TON, and Stacks
• Shell histories
• FileZilla FTP configuration and recent-server data
• Basic system information and the public IP address

The harvesting module packages the collected information and a summary log file into a ZIP archive, then uploads it via the Telegram Bot API.

Files larger than 40 MB are split into smaller parts, while retry logic ensures that uploading resumes after temporary network failures.

The final module is a modified version of the open-source tool GSocket that acts as a persistent backdoor for the attackers.

The backdoor establishes persistence through multiple methods, including a LaunchAgent, crontab entries, and modifications to shell configuration files.

It connects through a GSocket relay, allowing the attacker to open a reverse shell and remotely control the system.

Unlike the other ClickLock modules that self-delete after execution, GSocket is the only component that persists on infected systems.

Group-IB warns that “malware leaves a narrow detection window” and that the malicious payloads are hosted on compromised legitimate domains with a clean reputation.

Additionally, the script is not flagged as malicious on VirusTotal, and its modules self-delete after execution, leaving no artifacts.

Despite this, the researchers say that detection is possible based on the activity generated by the malware, such as osascript launching password dialogs, repeated process termination, mass access to browser profile directories, and outbound connections to Telegram’s API.

To defend against these attacks, users should avoid pasting in Terminal commands they don’t fully understand, especially if the request comes from a website.

“Any page that instructs you to open Terminal, regardless of how professional it looks, is attempting to compromise your system,” the researchers say.

If prompted to enter the login password when the rest of the system appears unresponsive, Group-IB recommends forcing a system shutdown by holding the power button and then booting into Safe Mode to recover the system.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Build starts limited alpha testing later this month.

1Password has launched a browser integration that lets Anthropic’s Claude use stored credentials to complete tasks on the web without the passwords ever reaching the AI model, according to a blog post published on Thursday. The company calls it a zero-exposure architecture: when Claude needs to sign in, 1Password shows the user which credential is being requested and why, then waits for biometric approval before injecting the login directly into the page. Claude never sees the vault item, password, or one-time code, and access ends when the task is complete.

The integration addresses a fundamental tension in agentic AI. Browser-based agents like Claude can navigate websites, fill out forms, and complete purchases, but reaching a login page has historically forced users to either hand over their password or take the wheel themselves. 1Password says this is the first browser integration that lets an agent use credentials without granting direct access to them.

After autofill, 1Password checks whether secrets were exposed on the page. If submission fails, the extension clears the filled values before returning control to Claude. The credential stays encrypted and controlled by 1Password throughout the process.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

The launch also introduces Agentic Mode, a feature in the 1Password browser extension that automatically locks down the vault when a compatible AI agent takes control. The agent can only use logins and one-time codes explicitly approved for the current task, and the rest of the vault stays out of reach. Agentic Mode activates even if the 1Password-Claude integration is not configured, and supports agents beyond Claude.

The timing is notable given that security researchers recently demonstrated how AI browsers could be tricked into leaking user credentials through prompt injection attacks, with Anthropic’s own Claude extension among those affected. 1Password CTO Nancy Wang said in the company’s announcement that the answer is not handing agents your secrets, but letting a user give an agent permission to use a credential without letting the agent see it. She called that distinction the foundation of trust in AI agents.

1Password for Claude is available now on Mac for business, family, and individual plans, and requires the 1Password desktop app, browser extension, Claude desktop app, and Claude browser extension. The company, which recently acquired Israeli startup Apono to govern AI agent access inside enterprise systems, said it plans to add support for payment cards and identity details after launch.

CNET’s password manager expert Joe Supan said he would normally be very wary about giving an AI agent access to his password manager, but that 1Password appears to have several good guardrails in place, particularly biometric authentication for each login. The integration marks the first time a major password manager has built a dedicated secure channel for an AI agent to use credentials at runtime, rather than exposing them to the model’s context. Whether the approach holds up against the kind of prompt injection attacks that have already compromised AI browsers remains to be seen.

The brand iRobot launched the first Roomba robot vacuum back in 2002, and popularity for the handy devices skyrocketed from there. Countless competitors have emerged, but Roomba is still going strong. Its latest models have all the new features we love, from doubling as a vacuum and a mop to fantastic navigation and suction. The Roomba Max 705 is currently keeping my house clean as I test it for our robot vacuum guide, and it’s doing a great job both mopping and vacuuming the floors in my massive second story.

Looking to own your own Roomba robot vacuum? These iRobot promo codes and coupons will make it more affordable than ever to own your own powerful robot vacuum from the iconic brand.

Save $400 Off for Fathers Day at iRobot

Give Dad the gift of a clean home (that’s easier than ever) with up to $400 off bestselling iRoomba robot vacuums. This means hundreds of dollars off popular models like the Roomba Plus 505 Combo, Roomba Max 705, and more. Act soon before Father’s Day passes and the deals disappear. A clean home has never been easier (or cheaper) to achieve.

iRobot Promo: Treat a Friend to 15% Off a Robot and Save $15 on iRobot Accessories

I once gifted a friend a robot vacuum and she regularly tells me how it’s a marriage saver. If you want to change a friend’s life (and potentially save their marriage) you can gift a friend 15% off a robot vacuum with this iRobot coupon code, and you’ll get $15 off robot accessories for yourself. A clean win for everyone.

Save 33% on the Roomba Max 705 With Anti-Tangle Brushes Using This iRobot Offer

I test lots of robot vacuums, and my favorite from iRobot’s lineup is the Roomba Max 705. It’s packed with two anti-tangle brushes, excellent navigation, a self-emptying base station, and left my home sparkling clean. It’s a great choice for a Roomba for pet hair, and it’s done a great job with the litter my cat leaves all over the house, too. Extra bonus: it’s gorgeous. You can get 33% off this powerful robot vacuum right now with this iRobot discount code.

Tackle Every Mess Effortlessly: $300 Off the Roomba Plus 405 Combo Robot With AutoWash Dock

Looking for something a little more affordable? The Roomba Plus 405 Combo Robot is cheaper but still packs mopping and vacuuming, and still comes with an auto-emptying docking station. It’s already a pretty affordable model and a great iRobot vacuum for hardwood floors, and right now you can get it for $300 cheaper with this iRobot coupon.

Save $290 on Smart Cleaning: The Roomba 205 DustCompactor Combo Robot Vacuum & Mop

If you don’t want a big base station in your home but still want a robot vacuum that can vacuum and mop, the Roomba 205 DustCompactor is for you. The Roomba 205 will compact and store debris for up to 60 days inside the robot itself, no emptying station required. It’s bagless, like my favorite Shark robot vacuum, so you don’t need to worry about buying and replacing bags to use the vacuum. If that sounds up your alley, don’t miss your chance to save almost $300 on this robot vac with this iRobot promo code.

Get 10% Off Your First iRobot Purchase When You Sign up for Emails

Not sure what you want to get from iRobot, but know you want an iRobot discount code? You can sign up for iRobot’s emails and get a code for 10% off whatever your first purchase is. Enjoy!

Save $500 on Max 705 Combo

The Roomba Max 705 Combo robot + AutoWash dock is the perfect household helper. With a self-cleaning roller mop, detailed edge cleaning, anti-tangle dual rubber brushes, and a powerhouse dock, this impressive robovac-mop combo takes all of the gruntwork out of the normal household cleaning chores. Usually $1,300, the Max 705 is nearly half off at $800. If you’ve been looking to upgrade your cleaning routine, snag this model for $500 less than usual, for a limited time.

Get 20% Off iRobot Accessories

An iRobot is an investment, requiring parts replacement, upgrades, and routine maintenance to keep your device in tip-top shape. iRobot knows this and wants to keep the costs down while maintaining the longevity of this top tech. Be sure to check out iRobot Accessory Offers for huge savings on genuine iRobot accessories for your robot, including up to 20% off with bundle deals. With this “buy more, save more” sale, you can build your own bundle for increased savings, so when you buy any 2, you’ll get 10% off; buy any 3, get 15% off; or when you buy any 4, you’ll get 20% off on eligible accessories. So whatever your need is, make sure you take advantage of this deal and stock up on essential accessories like filters, dirt disposal bags, replacement parts and more.