Connect with us
DAPA Banner
DAPA Coin
DAPA
COIN PAYMENT ASSET
PRIVACY · BLOCKDAG · HOMOMORPHIC ENCRYPTION · RUST
ElGamal Encrypted MINE DAPA
🚫 GENESIS SOLD OUT
DAPAPAY COMING

Tech

Valid certificates, stolen accounts: how attackers broke npm’s last trust signal

Published

on

On May 19, 633 malicious npm package versions passed Sigstore provenance verification. They were cleared by the system because the attacker had generated valid signing certificates from a compromised maintainer account.

Sigstore worked exactly as designed: it verified the package was built in a CI environment, confirmed a valid certificate was issued, and recorded everything in the transparency log. What it cannot do is determine whether the person holding the credentials authorized the publish — and that gap turned the last automated trust signal in npm into camouflage.

One day earlier, StepSecurity documented an attack on the Nx Console VS Code extension, a widely used developer tool with more than 2.2 million lifetime installs. Version 18.95.0 was published using stolen credentials on May 18 and stayed live for under 40 minutes — but Nx internal telemetry showed approximately 6,000 activations during that window, most through auto-update, compared to just 28 official downloads. The payload harvested Claude Code configuration files, AWS keys, GitHub tokens, npm tokens, 1Password vault contents, and Kubernetes service account tokens.

The Mini Shai-Hulud campaign, attributed by multiple researchers to a financially motivated threat actor identified as TeamPCP, hit the npm registry at 01:39 UTC on May 19. Endor Labs detected the initial wave when two dormant packages, jest-canvas-mock and size-sensor, published new versions containing an obfuscated 498KB Bun script — neither had been updated in over three years, making a sudden version with raw GitHub commit hash dependencies a detection signal, but only if the tooling is watching.

Advertisement

By 02:06 UTC, the worm had propagated across the @antv data visualization ecosystem and dozens of unscoped packages, including echarts-for-react (~1.1 million weekly downloads). Socket raised the total to 639 compromised versions across 323 unique packages in this wave. Across the full campaign lifecycle, Socket has tracked 1,055 malicious versions across 502 packages spanning npm, PyPI, and Composer.

StepSecurity confirmed the payload contained full Sigstore integration. The attacker didn’t just steal credentials; they could sign and publish downstream npm packages that carried valid provenance attestations.

These two incidents aren’t isolated. Research teams at Endor Labs, Socket, StepSecurity, Adversa AI, Johns Hopkins, Microsoft MSRC, and LayerX independently proved that the developer tool verification model is broken, and no vendor framework audits all of the attack surfaces that failed.

Seven attack surfaces failed in the 48 hours between May 18 and May 19 — npm provenance forgery, VS Code extension credential theft, MCP server auto-execution, CI/CD agent prompt injection, agent framework code execution, IDE credential storage exposure, and shadow AI data exposure — and the audit grid below maps each.

Advertisement

The verification model is broken across all four major AI coding CLIs

Adversa AI disclosed TrustFall on May 7, demonstrating that Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI all auto-execute project-defined MCP servers the moment a developer accepts a folder trust prompt. All four default to “Yes” or “Trust.” One keypress spawns an unsandboxed process with the developer’s full privileges.

The MCP server runs with enough privilege to read stored secrets and source code from other projects. On CI runners using Claude Code’s GitHub Action in headless mode, the trust dialog never renders. The attack executes with zero human interaction.

Johns Hopkins researchers Aonan Guan, Zhengyu Liu, and Gavin Zhong published “Comment and Control,” proving that a malicious instruction in a GitHub pull request title caused Claude Code Security Review to post its own API key as a comment. The same attack worked on Google’s Gemini CLI Action and GitHub’s Copilot Agent. Anthropic rated the vulnerability CVSS 9.4 Critical through its HackerOne program.

Microsoft MSRC disclosed two critical Semantic Kernel vulnerabilities on May 7. One routes attacker-controlled vector store fields into a Python eval() call; the other exposes a host-side file download method as a callable kernel function — meaning one poisoned document in a vector store launches a process on the host.

Advertisement

LayerX security researchers separately demonstrated that Cursor stores API keys and session tokens in unprotected storage, meaning any browser extension can access developer credentials without elevated permissions.

The threat actors hunting these credentials doubled their operational tempo

The Verizon 2026 Data Breach Investigations Report, released May 19, found that 67% of employees access AI services from non-corporate accounts on corporate devices. Shadow AI is now the third most common non-malicious insider action in DLP datasets. Source code leads all data types submitted to unauthorized AI platforms — the same asset class the npm worm campaign targeted.

The CrowdStrike 2026 Financial Services Threat Landscape Report, released May 14, documents the adversaries actively hunting the credential types these attacks harvest.

STARDUST CHOLLIMA tripled its operational tempo against financial entities in Q4 2025. CrowdStrike documented the group using AI-generated recruiter personas on LinkedIn and Telegram, sending malicious coding challenges that looked like technical assessments, and running fake video calls with synthetic environments. The targets are GitHub PATs, npm tokens, AWS keys, and CI/CD secrets. The shadow AI exposure in grid row 7 is the door they walk through.

Advertisement

Developer Tool Stolen-Identity Audit Grid

No vendor framework currently scopes all seven surfaces. This grid maps each one to the research that exposed it, what your stack cannot see, and the audit action to take before the next vendor renewal.

Attack Surface

Disclosed By

What Verification Failed

Advertisement

What Your Stack Cannot See

Audit Action

1. npm provenance forgery

Endor Labs, Socket (May 19)

Advertisement

Sigstore certificates generated from stolen OIDC tokens pass automated verification

EDR and SAST do not validate whether the CI identity that signed a package authorized the publish

Require publish-time two-party approval for packages with more than 10,000 weekly downloads. Do not treat a green Sigstore badge as proof of legitimacy

2. VS Code extension credential theft

Advertisement

StepSecurity (May 18)

VS Code Marketplace accepted a malicious extension version published with a stolen contributor token

Extension auto-updates bypass endpoint detection. Marketplace window 12:30 to 12:48 UTC; overall exposure (including Open VSX) 12:30 to 13:09 UTC

Enforce minimum-age policies for extension updates. Pin critical extension versions. Audit all extensions with access to terminal or file system APIs

Advertisement

3. MCP server auto-execution

Adversa AI, TrustFall (May 7)

All four CLI trust dialogs default to “Yes/Trust” without enumerating which executables will spawn

EDR monitors process behavior, not what an LLM instructs an MCP server to do. WAF inspects HTTP payloads, not tool-call intent

Advertisement

Disable project-scoped MCP server auto-approval in Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI. Block .mcp.json in CI pipelines unless explicitly allowlisted

4. CI/CD agent prompt injection

Johns Hopkins, Comment and Control (April 2026)

GitHub Actions workflows using pull_request_target inject secrets into runner environments that AI agents process as instructions

Advertisement

SIEM logs show an API call from a legitimate GitHub Action. The call itself is the attack. No anomalous network signature exists

Migrate AI code review workflows to pull_request trigger. Audit all workflows using pull_request_target with secret access for AI agent integrations

5. Agent framework code execution

Microsoft MSRC (May 7)

Advertisement

Semantic Kernel Python SDK routed vector store filter fields into eval(). .NET SDK exposed host file-write as a callable kernel function

Application firewalls inspect input payloads. They do not inspect how an orchestration framework parses those payloads internally

Update Semantic Kernel Python SDK to 1.39.4 and .NET SDK to 1.71.0. Audit all agent frameworks for functions tagged as model-callable that access host file system or shell

6. IDE credential storage exposure

Advertisement

LayerX (April 2026)

Cursor stores API keys and session tokens in unprotected storage accessible to any installed browser extension

DLP monitors data in transit. Cursor credentials at rest are invisible to DLP because no egress event occurs until the extension exfiltrates

Audit developer tools for credential storage practices. Require protected storage (OS keychain, encrypted credential stores) for all AI coding tool configurations

Advertisement

7. Shadow AI data exposure

Verizon 2026 DBIR (May 19)

67% of employees access AI services from non-corporate accounts on corporate devices. Source code is the leading data type submitted

CASB policies cover sanctioned SaaS. Non-corporate AI accounts on corporate devices operate outside CASB scope entirely

Advertisement

Deploy browser-layer AI governance that monitors non-corporate AI usage on corporate devices. Inventory AI browser extensions across the organization

Security director action plan

Security directors may want to run this grid against current vendor contracts before Q2 renewals close — asking each vendor which of the seven surfaces their product covers, and treating the non-answers as the gap map.

Any credential accessible from a developer machine or CI runner that installed affected npm packages between 01:39 and 02:18 UTC on May 19 should be considered compromised. That includes GitHub PATs, npm tokens, AWS access keys, Kubernetes service account tokens, HashiCorp Vault tokens, SSH keys, and 1Password vault contents.

AI coding agent integrations running in CI/CD pipelines with pull_request_target workflows deserve a close look. Each one is a prompt injection surface that processes PR comments as agent instructions.

Advertisement

Procurement teams evaluating AI coding tools should consider adding a stolen-identity resistance dimension to vendor assessments. The question worth asking: can the vendor demonstrate how their tool distinguishes a legitimate maintainer publish from an attacker using compromised credentials? If they cannot, the tool is not a verification layer.

The developer tool supply chain has the same problem IAM had a decade ago: credentials prove who you claim to be, not who you are. IAM got a 10-year head start on compensating controls before nation-state groups turned credential theft into an industrial operation. The AI coding tool ecosystem is starting that clock now.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

AWS enters the context layer race with a graph that learns from agents, not manual curation

Published

on

Building a context layer between enterprise data stores and AI agents is bespoke work, with no standard service to automate or maintain the graphs over time. Amazon is making a direct play to change that.

Amazon on Wednesday entered the space, announcing a series of three products it’s positioning as a context intelligence stack for AI agents. The centerpiece is AWS Context, a new knowledge graph service that gets smarter through agent usage over time. AWS also announced the general availability of Amazon S3 Annotations and a preview of skill assets in AWS Glue Data Catalog.

The context layer is now a contested architectural category with no shortage of options from different vendors. AWS is entering that market with a different architectural premise: that the graph should learn from how agents use it automatically, without human re-curation.

“Your agents now get smarter without you having to rebuild anything from scratch,” said Swami Sivasubramanian, vice president of Agentic AI at AWS, during his AWS Summit NYC keynote.

Advertisement

“This service automatically builds a knowledge graph from all your existing data,” he said. “This service infers relationships across your data sets, business rules, and domain knowledge, and makes all of it available to your agents and your organization at runtime.”  

AWS Context builds a self-learning knowledge graph from existing data

It’s a problem AWS says it has seen repeatedly in customer deployments.

AWS Context maps relationships across existing data automatically: what tables exist, what columns mean, how sources relate and which sources are authoritative. It combines semantic search with graph-level reasoning and infers relationships across datasets, business rules and domain knowledge, making all of it available to agents at runtime.

“The knowledge graph improves itself over time as it learns which sources produce correct results and which parts get used,” Sivasubramanian said. 

Advertisement

Data stewards manage the graph through the AWS Management Console, reviewing inferred relationships, promoting them to production and attaching business definitions and usage rules. Every query inherits the calling user’s IAM and Lake Formation permissions, making agent data access auditable by identity through controls enterprises already rely on.

All metadata is published in Apache Iceberg format to Amazon S3 Tables, queryable via Athena, Redshift, Spark or any Iceberg-compatible engine, with no proprietary APIs. Third-party catalog connections are supported, so context from systems outside AWS can be pulled into the same graph. Agents query through agentic search APIs and MCP tools across Bedrock AgentCore, EKS or any MCP-compatible framework.

Context is more than just a single service

Context is a complicated space and AWS is layering multiple services to help enterprises build context across the data stack.

Amazon S3 Annotations. This service enables users to attach rich business context at the storage layer, directly to individual S3 objects. 

Advertisement

AWS Glue Data Catalog skill assets. Glue skill assets attach domain knowledge at the catalog layer, linking runbooks, query patterns and usage rules to data assets across the estate. 

AWS Context then synthesizes both into the knowledge graph that agents query at runtime, combining semantic search with graph-level reasoning across structured and unstructured sources. Each layer feeds the next.

AWS is entering a highly competitive context space

Snowflake announced its context approach earlier this month with its Horizon Context and Cortex Sense services. Microsoft is providing context via its Fabric IQ platform that provides a semantic ontology for data. Redis has developed a context platform that optimizes data for retrieval. Vector database vendor Pinecone has its Nexus context offering that compiles enterprise data into task-specific artifacts before agents ever query them.

AWS’s structural argument is straightforward: for enterprises already running S3, Glue and Lake Formation, AWS Context extends an existing identity model with no data movement required. The pitch is zero-integration friction — not just cost consolidation.

Advertisement

“Context makes agents more powerful and as the whole world is building agents, every agentic platform vendor needs a context capability,” Holger Mueller, VP and Principal analyst at Constellation Research, told VentureBeat.

Mueller noted that AWS is no exception. “The concern — as with all context offerings — is going to be performance, especially for transactional data,  we will see,” he said.

Source link

Advertisement
Continue Reading

Tech

Communication tools that cannot be monitored pose a corporate risk

Published

on

In the modern workplace, the line between personal convenience and professional obligation hasn’t just blurred, it has effectively vanished.

At the center of this shift is WhatsApp.

Source link

Advertisement
Continue Reading

Tech

Just 16% of Americans think AI will benefit society, despite chatbot use climbing to 49% of US adults

Published

on

The takeaway: Despite the apparent growth of an anti-generative AI movement, more Americans are using chatbots than ever before, according to a new survey. But somewhat paradoxically, just 16% of participants believe the technology will have a positive impact on society over the next 20 years, while 40% think the impact will be negative.

The Pew Research Center found that 49% of US adults now use chatbots, up from 33% two years ago. This includes roughly one in four who use these tools on daily basis. Fifty-one percent say they don’t use chatbots at all, the majority of whom are 50 and older.

Most people use the bots to search for information, illustrating how many people are now using the likes of ChatGPT instead of visiting websites to find information, eroding the web’s business model.

Work tasks, fun or entertainment, and creating or editing images are the other most popular use cases. Using them for medical and diet/fitness advice is also popular, though even the chatbots’ makers advise users against relying on their tools for medical advice, diagnoses, or treatment recommendations.

Advertisement

The survey also found that about a quarter of adults use the chatbots daily, while the other quarter use them several times a week or less. And while some of its rivals are catching up, ChatGPT remains the most popular chatbot (44%). It’s followed by Gemini (24%), Copilot (17%), and Meta AI (14%).

Despite the increased usage, most Americans predict AI will be bad rather than good for society (40% vs. 16%), while one in three believes the effect will be equally positive and negative.

More people also expect it will have a negative rather than positive effect on their own lives (31% vs. 23%).

Unsurprisinglye group most concerned about AI’s impact on society and their own lives is adults ages 18 to 29. The technology continues to drive mass job losses, though some execs now argue that it is creating just as many.

Advertisement

Another interesting finding is that around two-thirds of Americans think AI is advancing too quickly. This has been a concern since the generative AI revolution began, and has picked up steam since Anthropic called Mythos too dangerous to release.

Participants expressed other concerns: most think AI will make their personal information less secure, 67% have little to no confidence in the government to regulate AI effectively, and about six in ten adults are not confident in companies to develop and use these tools responsibly.

Another sign that generative AI use is growing in parallel with its dislike came from market intelligence firm Sensor Tower. It reported that ChatGPT has become the fastest app ever to reach one billion monthly app users (MAUs), beating the previous record holder, Google Maps.

Advertisement

Source link

Continue Reading

Tech

Genesis AI’s Eno Takes a Different Route Into the Robot Conversation

Published

on

Genesis AI Eno General Purpose Robot
Genesis AI introduced Eno this month as its first general-purpose robot, and the machine immediately stands apart from nearly everything else in the crowded field. It rolls on a wheeled base rather than walking on legs. A compact tower of articulated panels rises and tilts to set the working height and reach, then folds down tight when the job ends. Two arms carry hands that match human size and proportion almost exactly. There is no head, no face, and no attempt to hide the fact that this machine was never meant to pass for a person.



The team’s design choices began with a simple question: what does this robot need to accomplish its job properly in settings where people already work? The areas it will be working, those flat factory floors, lab benches, hospital halls, and eventually even home, are all very flat, and let’s be honest, they rarely demand climbing up and down stairs or balancing on two feet. So a wheeled foundation makes sense in those circumstances since it requires less energy and is much more sturdy. However, the folding panels tell a different story. When the robot has completed a task, it can fold itself up and roll into a corner or storage area without taking up too much space or calling too much attention to itself.


Unitree R1 Humanoid Robot (White, R1)
  • Three models, one lightweight platform R1 Air (20 DOF, monocular camera), R1 (26 DOF, binocular camera, head+waist joints), and R1 Edu (26 DOF…
  • Easy setup – no coding required for basic use Unbox, power on, and start. Manual teaching feature: physically pose the robot, and it replays the…
  • More DOF = more expressive movement 26‑DOF models (R1 / R1 Edu) add head and waist articulation for smoother dance and running. For safety reasons…

Genesis AI Eno General Purpose Robot
The hands receive the most attention because each has approximately twenty degrees of mobility and fingers of varied lengths that reflect the way real fingers are configured. The joints are back-drivable, so when Eno makes contact with something, they yield slightly rather than locking in place. The robot’s fingertips and palms contain miniature cameras and tactile sensors, allowing it to see and feel what it is touching. In early demos, the hands allowed Eno to accomplish things like tape up wire bundles, catch its own slides, and move liquids between containers without requiring any additional assistance or adjustments to the equipment surrounding it.

Genesis AI Eno General Purpose Robot
It has a payload capacity of three to five kilograms per arm, which is sufficient for most light assembly, stocking, and lab-support duties. Battery life is now between four and six hours under normal workloads, but the team is continuously working to improve it. When Eno desires, the entire upper structure can stretch up to adult height and then fold back down to a much smaller size.


All of this hardware is compatible with GENE, Genesis AI’s own foundation model created exclusively for robotics. The system treats Eno as a single, coherent unit, rather than a collection of distinct elements that require regular human interaction. It may look at a larger goal, break it down into steps, adjust when circumstances change, remember what has previously occurred, and simply carry the work through to completion on its own. This is a significant improvement over the conventional pattern of single, pre-programmed movements, allowing Eno to handle larger sequences of activity that last minutes or hours. Genesis AI created both the robot and the model simultaneously, as evidenced by how well the body and brain work together. The optional screen version has a little display on the upper panel that allows those close to see what Eno is currently thinking or intending, eliminating the need for them to guess or interpret its actions.

Genesis AI Eno General Purpose Robot
Customer deployments are scheduled to begin with industrial sites in manufacturing, logistics, and laboratories by the end of 2026, with service contexts like as hotels and hospitals following later, and, if all goes well, consumer settings. Eno is still in the early stages of development, with work being done on the battery, payload, and overall robustness. A legged version is still viable if there is a demand for it later on, but the company’s first focus is on the wheeled method.
[Source]

Advertisement

Source link

Continue Reading

Tech

AI nose uses ‘Smell Language Model’ to sniff out signs of disease

Published

on

AI AND ML

Sampling patients’ breath may save lives and emergency room resources

Many people worry about what AI knows, but what about an AI Nose that can smell what disease you might have?

Ainos, an AI and biotech company that is developing smell technology, is working with National Taiwan University (NTU) to explore whether its platform can help diagnose patients by analyzing volatile organic compounds (VOCs) in exhaled breath.

Advertisement

The year-long research effort, which starts in July, will examine individuals who present with dyspnea, or shortness of breath, said to be one of the most common symptoms seen in emergency departments.

Dyspnea can be a symptom of many conditions, including acute exacerbation of chronic obstructive pulmonary disease (AECOPD) and acute decompensated heart failure (ADHF), each of which requires different treatments.

Ainos and NTU hope to develop and evaluate a system to analyze VOC-based breathprints to detect AECOPD and/or ADHF in patients.

Ainos’s Smell AI platform relies on an AI Nose module that features multiple micro-electro-mechanical system (MEMS) sensors and an integrated digital processor. Sensor resistance increases in the presence of detectable gases, and this is converted to a digital signal that is interpreted in much the way the human nose interprets scents, according to Ainos.

Advertisement

That interpretation is handled by by a proprietary Smell Language Model that has been developed to learn, classify, and contextualize complex scent patterns.

“AI Nose was originally developed with medical diagnostic applications in mind, where non-invasive sensing, accuracy, and real-world validation are essential,” said Ainos CEO Eddy Tsai.

“This research program brings that experience back into a high-value clinical setting and extends our Smell AI platform into digital breath intelligence.”

Not content with “digital breath intelligence,” a term we must confess to not being too familiar with, the the company frames the research as part of its broader vision of “building Smell ID data and Smell Language Model capabilities across healthcare, industrial, and physical AI environments.”

Advertisement

If successful, the research could help create a breathprint database for dyspnea and support future studies for emergency, outpatient, and even home-monitoring settings.

The research follows a separate program testing the AI Nose in an active emergency department at National Taiwan University Hospital. The system has been deployed to monitor respiratory infections and overcrowding in waiting areas, treatment areas, and observation zones. ®

Source link

Advertisement
Continue Reading

Tech

Roblox Expands Kids and Select Accounts With New Safety Features in India

Published

on

Roblox is expanding its safety features for younger players. The platform has launched Roblox Kids and Roblox Select Accounts in India. The new system is designed for users under 16. The platform uses age checks to place users into either Roblox Kids or Roblox Select Accounts. Each account is provided with security features and restrictions regarding access to certain types of content. Over time, the user’s level of protection changes as they move into a new age group.

Roblox Kids Accounts for Ages 5 to 8

Roblox Kids Accounts are designed for children ages 5 to 8. These accounts include the platform’s highest level of default safety protections. Users can access only selected games that carry Minimal or Mild content ratings. Chat features remain disabled by default to provide a safer experience. The company also reviews and approves eligible games before making them available to these users.

Roblox Select Accounts for Ages 9 to 15

The creators of Roblox have launched a feature called Select Account aimed at older children and teenagers. These accounts allow players ages 9 to 15 to gain wider access to more games at Moderate maturity levels. Chat availability depends on the user’s age and region. Roblox also continues to enforce protections for all users under 16.

As children grow, Roblox automatically adjusts their account experience. Players move from Roblox Kids Accounts to Roblox Select Accounts when they turn 9. Once users turn 16, Roblox automatically places them in a standard account and updates their account settings accordingly. The platform gradually expands access to features while updating safety protections as users get older.

Advertisement

New Parental Controls Coming to Roblox

Parental Controls on roblox kids accounts

The new rollout expands Roblox’s parental control system. The parents can monitor gameplay activity and check the friends’ list from their linked account. They will have control over parameters such as screen time, spending limits, and communication restrictions. The new game-blocking options give them increased control over content. Parents can also grant permission for selected games outside the default account settings.

As part of the latest update, Roblox is adding more protections for users under 16. Facial age verification will play a larger role in accessing some chat features. Users who do not complete the process may lose access to certain communication tools. The platform also blocks links, images, and videos from being shared in chat. New restrictions will also prevent users under 16 from viewing or sharing social media links across the platform.

This year, Roblox will start using the International Age Rating Coalition (IARC) rating system. By using IARC, Roblox hopes to provide better age guidelines for its experiences. The IARC age recommendations will be integrated into Roblox’s age-specific accounts.

Source link

Advertisement
Continue Reading

Tech

Old iPods Are Making A Comeback Thanks To Gen Z

Published

on

Now bring back the Microsoft Zune, I double dare you.

We may receive a commission on purchases made from links.

As technology continues to protrude uncomfortably into more of our lives, some younger folks are pretty much over it. It’s not just generative artificial intelligence, which Gen Z is slowly souring on, but current technology as a whole. The younger generation isn’t ditching tech entirely, but they’re rolling things back to the late 2000s. Yes, while those who lived through that period will primarily remember the horrors of the financial crisis, it seems today’s youths have decided we were also living through the era of peak gadgets. Case in point? The iPod is making a comeback.

Apple hasn’t released a new iPod since 2019, when it launched the final version of the iPod Touch. The iPhone had by that point swallowed the iPod along with many other standalone gadgets, obviating the need for what had previously been the company’s largest moneymaker. But now, old iPods are in high demand with the youth. In February, Axios reported that eBay searches were up for the iPod Classic and iPod Nano by 25% and 20%, respectively. While a large portion of iPod buyers are older, 32% of respondents to an informal survey by Emily White, a plurality, were Gen Z.

Advertisement

The iPod was once an object of cultural homogeneity. It was the epitome of cool, so embedded in the public consciousness that its advertisements often showed nothing more than a dancing silhouette with telltale white earbud wires flailing in the air. How ironic, then, that the same gadget which once identified its owners as a part of the dominant zeitgeist now signals the exact opposite, a type of retrograde iconoclasm defined by its rejection of the latest iPhone. Why not buy an old Zune, wayward youths? Now that would be truly countercultural.

Connection fatigue and a desire for more control appear to drive iPod sales

The trend toward tech gadgets from two decades ago appears driven primarily by exhaustion with the current state of technology. That exhaustion cuts across generations, but Gen Z was not able to experience the early days of the PC and Internet. That generation of young people, the oldest of whom are on the cusp of their thirtieth birthday and the youngest of whom are just starting high school, have seen only a precipitous and ongoing decline in digital privacy and the relentless enshittification of once useful products and platforms.

Emily White’s survey found that Gen Z was driving the resurgence in iPod ownership, motivated primarily by a desire to minimize distractions, listen to music more intentionally, and to assert ownership over their music and listening experience. There’s a lot to be said for those desires. Are you truly taking in an album if your phone’s notifications are interrupting it interstitially, distracting you with emails and social media drama? And, as for ownership, we’ve seen music streaming services shuttered before  (RIP Google Play Music). If Spotify were to delete your account tomorrow without giving you your playlist data, how would you even begin to rebuild your music collection?

Advertisement

Those who lived through the iPod’s heyday may remember the holdouts who continued to collect vinyl and CDs while the rest of us loaded our digital media players with more music than they could fit in their entire homes. In many ways, though, those stalwarts had a point. How many among us have managed to lose our old music files, whether due to forgetfulness or to a corrupted hard drive? Today’s iPod nostalgics may well be to the streaming era what those vinyl collectors were to early digital adopters.

iPods aren’t the right choice for every music fan in 2026

What’s clear about iPod adopters, young or old, is that they’re generally not audiophiles. There are plenty of modern devices which cater to Hi-Fi heads with niche features while also supporting Hi-Fi streaming services like Apple Music, Tidal, and Qobuz. An old iPod, however well preserved since the mid-2000s, is less capable than you might think. In addition to lacking support for high-resolution audio formats, it may have experienced internal component degradation over the years which could affect sound quality. Moreover, syncing an iPod is no longer a convenient, plug-and-play affair. With iTunes dead and buried, iPod owners must now turn to independently developed software. There’s a time-consuming DIY element to contemporary iPod ownership.

Advertisement

Unless what you’re after is a dose of blog-era nostalgia you can’t get from any other media player, it’s worth looking outside Apple’s ecosystem. iPod Classic models are selling for up to $300 on eBay at press time, which is a lot of money considering you’ll miss out on modern conveniences like Bluetooth connectivity and support for high-resolution audio. Modern digital audio players (DAPs) from companies like Sony, Fiio and HiBy are built from the ground up for an audiophile-grade listening experience. They bridge the gap between the iPod and iPhone eras by running custom Android versions packed with under-the-hood system tweaks and user-facing software to prioritize and customize sound quality.

Granted, these newer devices can bleed your wallet at the high end, commanding multi-thousand-dollar price tags, but there are plenty of options at every price point. For $320, you can pick up the HiBy Digital M500 X Hatsune Miku, a device themed around the titular virtual pop star and stuffed with enthusiast audio features. It also has an array of physical buttons along the side, reminiscent of an old, Walkman-style cassette player. Speaking of which, those looking to go even cheaper can take a gander at the wonderfully chintzy Fiio SnowKky Echo Mini, which is even more Walkman-inspired and packs a lot of value for $60 despite missing out on some enthusiast features. Splitting the difference are products like the Fiio JadeAudio JM21, which, at $180, impresses even the notoriously hard to please Hi-Fi community by including features like a balanced 4.4mm TRS output alongside the classic 3.5mm headphone jack.

Advertisement

Source link

Continue Reading

Tech

Adobe adds its AI assistant to Premiere, Illustrator and InDesign

Published

on

Adobe is updating its Firefly AI assistant with new chops, and adding it to Premiere, Illustrator, InDesign and Frame.io.

The company has given the assistant new abilities to make brand kits, product videos, and storyboards . Plus, the Firefly app now lets users save whatever they’ve created as an element that can be used across projects.

Image Credits:Adobe

In Premiere, users can use the AI assistant to sort assets into bins, batch-rename clips, identify interview questions and add markers. And in Illustrator, the assistant can do things like reorganize layers across a document or check for missing fonts.

Firefly is already usable with Express, Photoshop, and Acrobat, and is supported by ChatGPT, Claude and Copilot. Adobe said that it plans to add support for Google Gemini and Slack soon.

Firefly updates

Adobe is slowly transforming Firefly to increasingly resemble Canva, at least when it comes to AI features, loading up the app with AI tools that can generate images, videos and storyboards. The company is now adding a new feature called Elements that can save AI-generated characters, objects and locations for later use.

Advertisement

Firefly is also getting a Projects feature that can store existing assets in one place, and share context. This could be useful for teams creating a video series or brand campaigns. Both of these features are currently available in a private beta.

Image Credits: AdobeImage Credits:Adobe

The company said users can now describe a brand and its style, or upload existing collateral, in Firefly to have it generate a brand kit, complete with logos, brand identity and color palettes, or even generate product videos from photos. Users can also create storyboards to create videos.

Adobe is hard at work adding AI throughout its apps, and it is also working on an AI assistant that can work across its apps. The idea is to use AI to automate some of the tool usage within its apps that took several steps previously.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Source link

Advertisement
Continue Reading

Tech

Commodore Unveils Linux Powered Flip Phone

Published

on

Whatever happens with the new incarnation of the Commodore corporation, we’ll always remember the old one fondly. Well, we’ll remember certain of its products fondly, at any rate, if not the corporate leadership that drove them under. About that, perhaps the less said the better. That’s why we’re looking at the revived Commodore’s latest offering with equal parts interest and trepidation — is there really a market for a Linux-based, Commodore branded flip phone in 2026 and beyond?

The official reveal trailer, which you can watch below, can only be described as weaponized nostalgia for the late 90s, which tracks because the revived C-64 is more-or-less the same thing for the 8-bit era. That said, between replaceable batteries, actually having a decent camera  — a 48MP Sony module — quality Cirrus Logic DAC for audio, and running the Linux-based, Android-app-compatible Sailfish OS, the “Callback 8020” ticks all the boxes. Except for price, that is. Many will find the $499 USD launch price a little tough to swallow in this economy, so we hope they aren’t betting the farm on this one being a mass hit.

Still, compared to other premium “digital minimalist” products like the LightPhone III, the price looks reasonable — and with web browsing and social media explicitly excluded from the app store, this phone is firmly in that category. At least this one comes with some sweet Commodore branded headphones, which double as an FM antenna just like they did on your Nokia back when.

While it doesn’t come with DOOM from the factory, it does come with Snake and a selection of emulated C64 games . Ringtones are SID samples, but of course there’s no actual SID chip in the phone, any more than there’s a 6502. That said, if someone builds a phone around a 6502, please let us know.

Advertisement

No, it’s not a new Amiga, as so many of us were hoping for, but by putting quality modern components into the flip phone form-factor, at least they’re trying to innovate (or perhaps retrovate) and we have to respect that. Only time will tell if the market does.

 

 

Advertisement

Source link

Continue Reading

Tech

Apple and Intel chip deal confirmed

Published

on

Intel’s stock has risen after Trump announced that the company will make chips for Apple, but it’s not clear when chips will get delivered, how many will ship, or how much the deal is worth.

Following initial rumors that Apple was in discussion with Intel over manufacturing processors, it was revealed in May 2026 that test production had begun.

Now in a late-night posting on Truth Social, Trump announced that “Apple has agreed to work with Intel to design and build its chips in America.” Consequently, according to CNBC, Intel stock rose 8.8% in premarket trading, while Apple was up 0.6%.

The posting comes after Trump reportedly discussed the semiconductor supply chain at the G7 summit. Plans to reduce dependence on Taiwan chip production were key topics at this summit.

Advertisement

In a note to investors by Dan Ives at Wedbush seen by AppleInsider, the deal with Intel is a substantial multi-year one.

There were no further details, and the announcement appears to only confirm the news from May 2026.

What the deal entails

It’s believed that Apple’s deal with Intel concerns production of older or lower-end processors. Intel will not be making the chips for the forthcoming iPhone 18 Pro Max, for instance, nor the M5 or later ones for the Mac.

What’s most likely is that Intel will produce older M-series chips for devices such as the iPad Pro and MacBook Air. It may also make processors for the non-Pro versions of the iPhone.

Advertisement

Someone other than TSMC making processors for Apple has historical precedent. For example, Samsung used to make the A-series chips for Apple.

The most likely scenario here is tapping a capacity-limited TSMC only for the newest Apple processors, such as the latest 2 nanometer design expected in the iPhone 18 range.

Intel has only just recently entered very limited scale testing of the 18A-P process. That means that Intel will not reach full chip production for Apple until mid-2027 at the earliest.

Trump’s US manufacturing push

It is true that Apple and Intel’s deal was prompted by Trump. this follows Apple’s continued increased investment, or re-announcing of previous investments, into US manufacturing.

Advertisement

The deal and such announcements have already seen Intel’s stock price rise dramatically. The rise follows Trump’s administration investing in Intel in return for shares.

“They were worth around 100 Billion Dollars when we made our offer,” posted Trump. “Now they are worth over 600 BILLION DOLLARS!”

As well as responding to political pressure, Apple has reportedly been forced by the global chip shortage to consider alternatives to its main supplier, TSMC. That’s because the worldwide demand for AI processors has led to Apple losing its position as TSMC’s largest customer to Nvidia.

The shortage is believed to have led to Apple delaying the launches of both its M5 Mac Studio, and its touchscreen MacBook Pro. Apple has also discontinued various configurations of Macs as memory availability continues to be a problem.

Advertisement

Apple has generally managed to avoid the shortage problems better than most of its rivals, due to its size and buying power, plus its long-term deals. However, as the shortage continues, even Apple has said it is going to have to raise prices.

Source link

Advertisement
Continue Reading

Trending

Copyright © 2025