The MSI Claw 8 EX AI+ is a high-octane handheld games console that can run PC and Xbox games from a wide range of game stores. With the Intel Arc G3 Extreme chipset — featuring the Intel Arc B390 GPU and 32GB RAM — it’s easily the most powerful portable console I’ve ever (quite literally) gotten my hands on. But there’s a pretty huge catch to that performance: a price tag that would buy you two Steam Deck OLEDs or a mid-price gaming laptop.

Let’s start with the superficial stuff: the MSI Claw 8 EX AI+ looks gorgeous. Its screen is an extensive eight inches across, offers wonderfully rich colors and a silky-smooth 120Hz refresh rate. Combined with its discreet RGB lighting around the asymmetrically placed thumbsticks and Void Purple colorway, it has a unique look that definitely helps it stand out from the crowd.

I filed a request with McDonald’s earlier this month to access all of the personal data the fast food company collected about me, and I received a stunning 515-page report a few days later that detailed my app interactions in granular detail and predicted I would never stop eating there.

Under the California Consumer Privacy Act, I have the legal right to request access to information from large companies that collect personal data. So I was curious what others might have on me, and I spent the next week filing more than 100 requests.

The CCPA went into effect in 2020, and three of its key provisions are the right to opt out of the selling of personal information, the right to delete that info, and the right to request a copy for yourself.

I focused solely on the latter—access requests—to better understand what data is being collected. Most companies must list two ways for you to file. These are often via a web form, phone number, or email address, as designated in their privacy policy. After you submit a request, companies can take 45 days to complete it.

My experience placing these data access requests was incredibly time-consuming, from finding the right filing methods to verifying my identity multiple times. Most exasperating during this process were the companies that either responded to my access requests with messages concerning the deletion of information, which I explicitly said not to do, or refused to process the request through a method listed in their privacy policy.

Consumer advocates I spoke with were upset with how these requests were handled. “That’s crazy,” said Ben Winters, director of AI and privacy at the Consumer Federation of America. “That’s not an acceptable status quo.” Winters sees these examples as exhibiting the weaknesses of policy frameworks that rely on companies to act responsibly and in good faith.

In accordance with WIRED’s policies, I am disclosing that I used generative AI to draft bureaucratic emails and update my tracking spreadsheet as part of this report. I wrote the body of this article mainly by hand in my scratch notebook.

One of the first errors came from Crunchbase, known for its database about tech startups. I emailed my access request to its privacy address on August 17. My message laid out the rights I wanted to exercise and included a direct request not to erase anything: “I am not requesting deletion at this time. Please do not treat this as a deletion request.” I received a reply two days later from a Crunchbase support representative.

“Thanks so much for your patience. Your account has been permanently deleted from Crunchbase. Please let me know if you need anything else!” the message read in full.

I followed up via email almost immediately, reiterating that I wanted data access, not data deletion. “Your Crunchbase user account was deleted. Other data located on Crunchbase was not deleted,” read the follow-up support response explaining what happened. If I wanted to have a Crunchbase account, I would have to reregister.

When I reached out to Crunchbase for comment, a spokesperson blamed the mistake on a “processing error” and said that the company would proceed with my original access request as filed. The spokesperson also claimed the misclassified response came from “a person on our customer success team” and not a generative AI tool.

My interactions with BeenVerified, a searchable database that gathers public records, also encapsulate my friction-filled experience placing these access requests.

I emailed BeenVerified’s dedicated CCPA compliance address on the morning of August 19. It laid out that I was a California resident placing an access request, not a deletion request. You’ll never guess what happened next.

Public Wi-Fi is safe enough for checking the weather or reading the news. It gets risky the moment you log into your bank, your email, or anything with a saved card number. A few minutes of setup, done before you connect rather than after, closes most of that gap.

Quick Take

Here is the short version, before the full walkthrough below. Do these five things every time you use a public network, in this order.

The rest of this guide walks through each step for phones, laptops, and the situations where these tips genuinely don’t apply.

Prerequisites

Do these things at home, on your own network, before you connect to public Wi-Fi anywhere. Setting them up at the airport or coffee shop, on the same connection you’re trying to protect, defeats the purpose.

Install a VPN app on every phone and laptop you travel with. Set it up now, so you’re not comparing options over an unsecured connection later. This list of VPN apps for Android is a reasonable starting point if you haven’t picked one for that platform.

Turn on automatic updates for your phone and your laptop. Most attacks that succeed on public Wi-Fi rely on a security hole that was patched months earlier. These basic cybersecurity habits cover this alongside a few others worth setting up once, not per trip.

Finally, turn on two-factor authentication for your email, banking, and any account you’d be upset to lose. If your bank or employer offers an authentication app instead of text-message codes, use that instead. Text codes can be redirected through a hijacked phone number; an app on your own device can’t be.

Know the Real Risks First

Evil Twin Networks

An evil twin attack happens when someone sets up a fake Wi-Fi hotspot using the same name as a real one nearby. Your phone can’t tell the difference by name alone. Once you join the fake network, the attacker can show you a fake login page, or simply watch what you send.

This is why confirming the network name with staff is step one in the Quick Take above. A coffee shop’s real network has exactly one name. Two networks with nearly identical names is the warning sign.

Man-in-the-Middle Interception

This attack doesn’t need a fake network at all. On an open, unencrypted Wi-Fi network, someone else connected to the same hotspot can potentially read data traveling between your device and the internet. This is called packet sniffing, and free tools that do it are easy to find online.

A VPN exists to stop exactly this. It wraps your traffic in its own encryption before it touches the local network, so anyone sniffing that network sees scrambled data instead of your actual activity.

Malware Delivered Through the Connection

Some public networks push malicious software onto connected devices, often disguised as a required “network login” app or a fake update prompt. Android phones face their own version of this: OMACP malware spreads through network configuration messages rather than a normal app install.

None of these three risks require you to be targeted personally. They’re automated and cheap to run against anyone who connects.

Which Steps Apply to You

Not every step below matters equally in every situation. Answer these questions first, then use them to judge how carefully to follow what comes next.

• What device are you using? Phones and laptops have different auto-join settings, covered separately in Step 2.
• What are you about to do? Checking sports scores carries little risk. Logging into your bank, checking email, or entering a card number means every step below applies, not just the easy ones.
• How long will you be on this network? A five-minute check-in at a departure gate is a different risk than working from a café for three hours, where a bad connection has more time to do damage.

If your answer to the second question involves money or a password, don’t skip the VPN or two-factor authentication steps, even if the rest feels like overkill for a quick visit.

Step-by-Step: Securing Your Connection

1. Step 1: Confirm the Network Name

   Ask an employee for the exact Wi-Fi name before you connect, or check a printed sign. Don’t guess based on which network looks official. If you see two networks with almost the same name, such as “Airport_WiFi” and “Airport_WiFi_Free,” treat both as suspicious until staff confirm which one is real.

   Expected outcome: you connect to a network you’ve manually verified, not just the strongest signal in the room.

   Advertisement

2. Step 2: Turn Off Auto-Join

   This step looks different by device. Find the version that matches what you’re using.

   On iPhone: open Settings, tap Wi-Fi, tap the network name, and turn off Auto-Join. This keeps the password saved but stops your phone from reconnecting on its own. To remove the network entirely instead, tap Forget This Network.

   

   On Android: open Wi-Fi settings, tap the gear icon next to the network, and look for a toggle labeled “Connect automatically” or similar. Exact wording varies by phone manufacturer, so search your settings app for “network suggestions” if you can’t find it under the network itself.

   On Windows or Mac laptops: uncheck “Connect automatically” at the connection prompt when you first join. If you already connected once without noticing that box, open your Wi-Fi settings, select the network, and turn the option off there instead.

   Expected outcome: your device asks before joining this network again, instead of doing it silently from inside your bag or pocket.

   Advertisement

3. Step 3: Turn On Your VPN Before You Open Anything Else

   Open your VPN app and confirm it shows as connected before you open a browser, email, or any other app. A VPN encrypts your traffic before it reaches the local network, so even a compromised hotspot only sees scrambled data.

   If you don’t already have a VPN installed, do this at home first. Setting one up for the first time on an unfamiliar network is exactly the situation you’re trying to avoid. When choosing one, look for an app with a kill switch, a feature that blocks all internet traffic if the VPN connection drops unexpectedly, so you’re never accidentally exposed mid-session without knowing it.

   Expected outcome: your VPN app shows an active, connected status before any other app touches the network.

4. Step 4: Turn Off File Sharing and Set the Network to Public

   On a Windows laptop, choose “Public” rather than “Private” when prompted after connecting to a new network. This turns off network discovery, so other devices on the same Wi-Fi can’t see your laptop or browse its shared folders. If you missed that prompt, you can turn off file sharing manually afterward.

   

   On a Mac, open System Settings, go to General, then Sharing, and make sure File Sharing and Screen Sharing are both switched off before connecting to public Wi-Fi.

   Expected outcome: your laptop is invisible to other devices on the network, and no folder on it can be reached from outside.

   Advertisement

5. Step 5: Check for HTTPS, But Don’t Trust It Completely

   Look for a padlock icon and “https://” before the website address in your browser. This means the connection to that specific site is encrypted, even on an unsecured network.

   Here’s the catch: scammers can put a padlock on a fake site too. The Federal Trade Commission points out that fraudulent sites are often encrypted as well, so a padlock alone proves the connection is private, not that the site itself is legitimate. Check that the web address is spelled correctly before you trust the padlock next to it.

   Expected outcome: you catch a misspelled or fake web address instead of trusting the padlock icon on its own.

6. Step 6: Turn On Two-Factor Authentication

   Before you travel, turn on two-factor authentication for your email, banking, and social media accounts if you haven’t already. A stolen password by itself then isn’t enough to get into your account, since the attacker would also need your phone or a code app.

   Expected outcome: logging in from a new device or location triggers a code request, blocking access even if your password leaked.

7. Step 7: Confirm Your Security Software Is Current

   Check that your antivirus or endpoint protection has updated within the last week before relying on public Wi-Fi. If you’re overdue for an update or don’t have one installed, a tool covered in this Bitdefender Total Security review is worth evaluating alongside whatever protection your device already includes.

   Expected outcome: your device can recognize and block known malware, rather than relying on the network alone to keep it out.

   Advertisement

Verify You’re Actually Protected

Troubleshooting

Where This Approach Has Limits

• A VPN and the steps above lower your risk significantly, but they don’t make public Wi-Fi risk-free. A few things are worth knowing honestly.
• A VPN encrypts your connection, but it does nothing against phishing. If you type your password into a convincing fake login page, the VPN protected the connection perfectly while you handed over the password anyway. Encryption and deception are different problems, and a VPN only solves one of them.
• A VPN also can’t remove malware already on your device. If something installed before you turned the VPN on, it keeps running underneath the encrypted tunnel.
• A VPN can leak your DNS requests, the lookups your device makes to find a website’s address, outside its encrypted tunnel if it’s misconfigured. That can reveal which sites you visit even though the content stays hidden. Most reputable VPN apps turn on leak protection by default, but it’s worth confirming in your provider’s settings if you want to be sure.
• Captive portals create a real gap of their own: they require an unencrypted connection to complete their login page before your VPN can even turn on. That short window, usually under a minute, is the least protected part of the whole process. Keep it brief and avoid opening anything sensitive during it.
• If you ever suspect an account was compromised despite these precautions, use this data breach checklist and change passwords from a trusted connection, not the one you suspect.

Key Takeaways

These habits cover Wi-Fi specifically. For broader habits like password managers and spotting phishing attempts, see this online safety guide.

FAQ

Meet the smallest and cheapest member of HP’s Smart Tank family, lowering the entry point for cartridge-free printing in the home or home office.

It’s a severely stripped-back print-only device with no auto-duplex mode, no ethernet port or paper drawer and a very basic display. but the print engine is the same as that of the more expensive HP Smart Tank 5100, so I’m hoping for decent prints with an unbeatable cost-per-page.

The pair of built-in, three Watt JBL speakers are adequate here, but as you can imagine, there’s very little in the way of bass frequencies. Dialogue can also get lost if there’s a lot going on in a scene, and it all sounds very localized. As a Bluetooth speaker, it’s perfectly fine, but it can’t compete with our top picks.

Battery Woes

With the average movie now running to 114 minutes, the Vibe One’s maximum 1.2 hours of battery life is, well, terrible. To even achieve that figure you’ll need to set it to Eco mode, which limits brightness considerably. Otherwise you’ll need to plug it in to watch anything over an hour long.

It’s the biggest flaw in an otherwise great little projector, and sadly limits its practicality. You’re better off considering the Vibe One’s portability a bonus feature rather than a reason to buy. You’d need to spend at least $100 more to punch through the 2-hour battery ceiling, or invest in a projector like the Soundcore Nebula Mars 3 ($1,149), which has a 5-hour battery life and 1,000 ANSI lumens of brightness.

Should You Buy One?

Despite its technological limits, the XGIMI Vibe One is extremely easy to enjoy. No, it isn’t bright enough for daytime viewing, the speakers are only adequate, and the battery won’t get you through most films. But for $250, you’re still getting a Full HD projector with Google TV, autofocus, keystone correction, and plenty of customization, all squeezed into a stylish, practical design that doubles as a speaker and lamp.

Photograph: Chris Haslam

It’s not the best portable projector, and it’s no TV replacement, but it is a great extra screen for spare-room cinema nights, kids’ sleepovers, and garden-wall projectors well after dark. Just treat the battery as backup rather than the main event, and keep the curtains closed.

The takeaway: Private conversations with AI chatbots are increasingly being used in court cases, creating a new source of evidence for police, prosecutors, and civil litigants. These records can expose a user’s intentions, private thoughts, and sensitive disclosures, yet they generally receive none of the legal confidentiality protections afforded to conversations with lawyers, doctors, or therapists.

ChatGPT and similar tools are often used for personal questions, legal worries, health concerns, and emotional support. Those conversations can feel private, but they may be accessible through a phone search, a subpoena, discovery in a lawsuit, or a report by the AI company itself.

A review by The Washington Post found chatbot conversations cited in 12 public court cases over the past two years. The number is likely higher because much of the evidence collected during investigations and lawsuits never becomes public.

One case involved a teenager identified in court records as R.K.C., who sued Meta, Snap, TikTok, and YouTube in 2023. He alleged that their platforms contributed to social media addiction and mental health problems.

Defense lawyers obtained his ChatGPT history during the case. In one October 2024 conversation, R.K.C. asked the chatbot to explain a statement from his father about a possible settlement.

“My dad Said that I’m will get a settlement worth of 1million dollar,” he wrote. “He said that If that doesn’t make me happy what does. What does he mean.”

R.K.C.’s lawyers settled with Snap, TikTok, and YouTube by late July. They also dropped the case against Meta, saying they were concerned about putting the teenager through a long trial. The companies denied his claims. Mike Morgan, a partner at Morgan & Morgan, said the ChatGPT messages did not affect the outcome of the case.

Credit: The Washington Post

Morgan said young people may share more with a chatbot than they would with family members, friends, or therapists. “A fifteen-year-old may type things into a chatbot that he may not say to a therapist, a parent, or a friend, and he does it without realizing that it could end up in a defense expert’s report,” he said in a statement.

Chatbot records have also become part of criminal cases.

In Palm Beach County, Florida, OpenAI contacted the FBI after a ChatGPT user repeatedly described plans to harm an ex-girlfriend, according to a police affidavit. The FBI passed the information to local police, who identified the woman and found that the user, Darren Zhou, had sent her anonymous messages after their relationship ended.

Police said the ChatGPT conversations supported the credibility of the threats. Zhou was arrested in May and charged with stalking and making electronic threats. He pleaded guilty this month and was sentenced to eight years of probation.

OpenAI has said it uses software to detect conversations that may involve dangerous behavior. Those conversations can be reviewed by staff. If reviewers determine there is “an imminent and credible risk of harm to others,” the company may contact law enforcement.

The company has not said how often it makes such reports. Its transparency data, however, shows a sharp increase in government and law-enforcement requests for user information. OpenAI disclosed data from more than 80 accounts during the second half of 2025, more than four times the total from the same period a year earlier.

In many cases, police do not need to obtain records from an AI company. They find the conversations on a person’s phone.

Michael Price, litigation director of the Fourth Amendment Center at the National Association of Criminal Defense Lawyers, said people often agree to let officers search their phones. In most situations, people have the right to refuse a search unless police have a warrant.

“The short answer is that most people consent,” Price told The Washington Post. “They shouldn’t, but they do.”

That happened in the case of Ryan Schaefer, a Missouri State University student accused of damaging 17 cars in a campus parking lot. According to police records, Schaefer agreed to let officers search his phone. They found ChatGPT messages he sent shortly after the alleged vandalism.

“How f—-d am i bro,” Schaefer wrote. “What if i smahsed the s— oitta mutlipls cars.”

He later wrote: “Is there any way they could know it was me.”

Schaefer later pleaded guilty to felony property damage and was sentenced in July to five years of probation.

AI chats can also be pulled into civil lawsuits through the discovery process. In a Michigan employment case, a tire salesman’s former employer alleged that he had taken customers after joining a rival company. The salesman had asked ChatGPT whether deleted Yahoo emails could still be retrieved, including through a court subpoena.

The employer argued that the messages showed he had tried to hide evidence. A judge later ordered him to pay an undetermined amount in attorneys’ fees and allowed the lawsuit to continue.

Chatbot exchanges do not have the legal protections that apply to conversations with lawyers, doctors, or therapists. OpenAI CEO Sam Altman has said AI conversations should have stronger privacy protections because people increasingly use chatbots for sensitive matters. Courts have not recognized that type of privilege.

A federal judge in New York made that clear in a case involving financial executive Bradley Heppner. Heppner argued that prosecutors should not be allowed to review his conversations with Anthropic’s Claude about potential fraud defenses. The judge ruled that the chats were not protected because Claude is not a lawyer and Heppner’s attorneys had not told him to consult the chatbot.

Heppner was convicted in May of securities fraud, wire fraud, and other charges.

The issue may grow as AI tools take on more tasks for users and gain access to more personal data. Andrew Ferguson, a law professor at George Washington University who studies digital surveillance, said chatbot records may be only the beginning.

“Your entire world is going to now be available for police,” Ferguson said.

Apple has a busy fall schedule ahead of it for 2026, beyond the usual iPhone launches. Here’s what to expect in September and October.

Historically, the fall is Apple’s biggest quarter when it comes to launches. Regular as clockwork, September is known as the time Apple brings out a new generation of iPhones and a bunch of other major products.

From Apple’s perspective, it’s perfect timing. It all happens a short time ahead of the lucrative holiday shopping season, with the sales reflected in its quarterly results.

The period is a therefore a very busy one, anchored around iPhones. However, it’s never just Apple’s latest smartphone models, as it usually involves the launch of other products and accessories to go with them.

With launch season already well underway, here’s all of the products you can expect to see come out of Apple in September and October.

Why September and October?

We are all well aware of the September events, but Apple has held more than just one event in the fall. In 2020, it held three events, with one each in September, October, and November.

The October event is very much a possibility for Apple. In the last decade, five years saw an October event, which acted as a Mac-centric overflow to the September one.

That said, Apple’s last October event was in 2023, with 2024 and 2025 just having the September one.

There is no guarantee of an October event, but it’s very much a possibility.

iPhone 18 Pro Max: September

The September event has been the iPhone event for many years, and there’s no reason not to expect that to happen this time either.

There will be a difference though, in that it will just be the Pro models. Due to Apple’s decision to split the launches so the standard models arrive in early 2028, that leaves just the iPhone 18 Pro and iPhone 18 Pro Max.

An iPhone 17 Pro Max. The iPhone 18 Pro Max should look quite similar.

Advertisement

Describable as a spec-bump update, the iPhone 18 Pro and Pro Max will move to the 2-nanometer A20 Pro chip. Thanks to some packaging changes, it should run cooler for longer, and therefore provide more performance.

You can also expect Apple to bring out the C2 modem, and there are hints of an under-display Face ID this time around.

The rear cameras on the Pro Max model is expected to benefit from a change for one sensor. The inclusion of a variable-aperture camera can help users create a real “bokeh” effect for their shots by controlling the focal range.

There are two other changes you can count on, thanks to the rumor mill. There has been talk of a dark cherry colorway, as well as price rises.

That could result in an increase of $300 over the iPhone 17 Pro models.

Folding iPhone: September

While the Pro models won’t have their lower-tier counterparts accompanying them in September, they won’t be alone. Apple’s folding iPhone, referred to frequently as the iPhone Fold or iPhone Ultra, will also take to the digital stage.

It’s a device with two screens, including a folding 7.8-inch internal version with a possible under-display camera.

A render of what the iPhone Fold or iPhone Ultra could look like – Image Credit: AppleInsider

Advertisement

A second 5.3-inch display will be on the outside, complete with a punch-hole camera. Two other 48MP rear cameras are expected.

Inside, it should include things like the A20 Pro and 12GB of memory running the show, to match its premium external appearance.

As with everything in tech, you can also expect a high price for the model. Previously, it was rumored to cost between $2,000 and $2,500, but the ongoing memory crisis can push that even higher.

Apple Watch Series 12 and Apple Watch Ultra 4: September

A typical accompaniment to the iPhone, the Apple Watch Series 12 won’t necessarily make waves. It isn’t expected to have a major overhaul this year.

That said, it should still come with some changes. There’s talk of a new health sensor inside a band, which could change how it monitors your heart through the day.

That band may also be accompanied by a new attachment method.

Apple Watch Series 11

There has also been a lot of talk about the return of premium ceramic models. If we’re lucky, we may even see two colors of ceramics being put on sale.

Other than that, there’s not much to really expect in terms of change for the standard Apple Watch.

The Apple Watch Ultra is also expected to get an update in 2026. However, it is entirely unclear what that update will entail.

AirPods 5: September

A periodic update to Apple’s personal audio accessories is usually a good bet for a September event. The rumor mill also agrees.

The AirPods 5 will reportedly arrive in standard and ANC versions in September, with the usual assurances of improved features.

One feature that has been heavily rumored and won’t make an appearance are AirPods Pro with cameras. As of one August 30 report, that model won’t be launching anytime soon, making them more likely to appear in 2027.

Operating Systems: September

Apple has long been testing the 27-generation operating systems. To go with Apple’s new hardware, you can also expect iOS 27, iPadOS 27, macOS 27 Golden Gate, watchOS 27, tvOS 27, and visionOS 27 to arrive at the same time.

The exact timings of their arrival will depend a lot on the supporting hardware. Usually, Apple releases its operating systems simultaneously as they ship, or in the days beforehand.

iPad mini 8: October

The iPad mini is long overdue an update, and it is rumored to get one in 2026. The eighth-generation is anticipated to turn up this fall, though on August 30, it was said to be coming in October, not September.

iPad mini 7 on an arm stand. No OLED yet.

When it does arrive, you can expect a big glow-up for the model. The usual spec-bump update to a new chip will occur, possibly to the A20.

The bigger change will be OLED, consisting of an 8.4-inch LTPS rear panel with a hybrid OLED treatment. It won’t have ProMotion with a refresh rate capped at 60Hz, but it will have a brighter and more vivid display.

Smart Home update: September/October

Apple has a lot to talk about for its smart home changes in 2026. So much so that it may not be easily squeezed into the iPhone event, and could be pushed into October.

The more obvious changes are the HomePod mini and Apple TV updates.

For the HomePod mini, think a spec-bump update to add Siri AI support and a price of around $129. Similarly, the Apple TV should get a chip update for Siri AI, though a new Siri Remote is also a possibility.

HomePod mini should get smarter this fall

The real thing to watch for is what we refer to as the Home Hub, an all-new device to act as the center of the smart home. Bearing a seven-inch display on a half-dome base, it will manage your smart home devices, and deal with notifications and calendar schedules.

An included camera will also let it work as an in-home intercom and for FaceTime calls.

It may not be the only version. A second model is expected, complete with a magnetic attachment system.

MacBook Pro: October

We would usually expect Apple to use the October event to handle Mac and MacBook updates. With the unexpected early updates to the Mac mini and Mac Studio, that reduces the number of Macs that Apple can potentially update.

There are rumors that Apple will be making a load of changes to its lineup in the coming six months, but whether that will be in late 2026 or early 2027 remains to be seen.

With MacBook Air updates anticipated to be in 2027, that leaves the MacBook Pro as the prime candidate for a fall update. Specifically, the 14-inch MacBook Pro with the M6 chip.

Don’t expect much here, aside from the chip change. The same miniLED screen with ProMotion support will be in play, as will the rest of the specifications.

While the fantasy of an OLED MacBook Pro is a good one, it’s also a very slim possibility. Even with rumors of it arriving in late 2026 or early 2027.

What works against it is how Apple likes to release the base MacBook Pro model of a chip generation, then wait a bit before bringing out the upper-tier versions. OLED would be a very premium feature, making it more likely to arrive later.

SOFTWARE

Microsoft veteran recalls how a CPU errata, a mythical ICE, and a single sneaky NOP saved Clippy’s big debut

Veteran Microsoft engineer Raymond Chen shared another fireside tale – one to strike fear into the hearts of engineers everywhere: the bug that can’t be replicated in the debugger.

The story begins near the end of the Word 97 release cycle, when a defect surfaced in the test labs but vanished the moment engineers reached for a debugger.

It was maddening. A script could trigger the crash fairly reliably, yet the instant anyone tried to hunt it down, the bug ducked out of sight.

Chen recalled: “The development team was very anxious, because a bug that appears only sporadically in the lab is going to occur regularly in the wild. But how do you debug a problem that resists debugging?”

It is every developer’s nightmare, even for those smug types who lean back in their chairs and tell testers “works alright here, mate.” There is a special place reserved in the afterlife for these developers.

With the bug refusing to cooperate, talk turned to an ICE (an In-Circuit Emulator, not the immigration agency), which could stand in for the CPU and allow breakpoints inside the emulated chip itself.

“To most software developers,” said Chen, “in-circuit emulators existed only in myth, and the possibility of acquiring one and using it was met with the excitement of a five-year-old boy who learns that he might get to ride on a fire truck.”

Eventually the team traced the problem to a specific manufacturer, and from there to a CPU erratum. The compiler in use at the time had been updated to dodge the problematic code sequence. However, by then the toolset had already been locked. Swapping in a new compiler risked introducing fresh, unknown bugs, so that was off the table.

The solution? Scour the binaries to find instances of the code that might upset CPUs. One was found. “To avoid introducing any new problems as a side effect of the fix, the team opted to do a binary patch to the binary to insert a nop into the offending code sequence.”

Word 97 introduced plenty of headline features. There was the arrival of Clippit (aka Clippy) and Visual Basic for Applications (VBA). And then there was a binary patch produced by determined engineers, which received far less attention. But without it, Word 97 could have been distinctly wobbly. ®