I look like a fox, I look like a wolfe, I look like a little bear, leave me alone.

HUMAN Security's Satori team has uncovered "SlopAds," a sophisticated ad fraud operation involving 224 Android apps downloaded over 38 million times across 228 countries[^1]. The apps use steganography to hide malicious code within PNG files and create hidden WebViews to generate fraudulent ad impressions and clicks[^1].

Key findings:

• Generated 2.3 billion daily bid requests at peak
• Heaviest traffic from US (30%), India (10%), and Brazil (7%)
• Only activated fraud for downloads traced to threat actor ad campaigns
• Used attribution tools and multiple layers of obfuscation to avoid detection
• Operated through extensive network of command-and-control servers

Google has removed the identified apps and enabled Google Play Protect warnings to block future installations[^1]. HUMAN's Ad Fraud Defense and Ad Click Defense customers are protected from SlopAds' impact[^1].

[^1]: HUMAN Security - Satori Threat Intelligence Alert: SlopAds Covers Fraud with Layers of Obfuscation

App list Domain list

A VPN that grants network-level privacy on mobile by routing app traffic through Tor, assigns each app a separate circuit for improved separation, bypasses app-level censorship, features per-app routing, security via Rust-based implementation, and awaits early adopter feedback.

A court ordered Google to pay $425 million after finding the company misled 98 million users about data collection through its "Web & App Activity" setting[^1]. The case revealed Google continued gathering user data via Firebase, a monitoring database embedded in 97% of top Android apps and 54% of leading iOS apps, even after users disabled data collection[^1].

Google's internal communications showed the company was "intentionally vague" about its data collection practices because being transparent "could sound alarming to users," according to district judge Richard Seeborg[^1].

This ruling adds to Google's recent privacy settlements, including:

• $392 million paid to 40 states in 2023 for location tracking violations
• $40 million to Washington state for similar location tracking issues
• $1.38 billion to Texas in 2025 over location tracking and incognito mode claims[^1]

Google plans to appeal the $425 million verdict, with spokesperson Jose Castaneda stating "This decision misunderstands how our products work" and asserting that Google honors user privacy choices[^1].

[^1]: Malwarebytes - Google misled users about their privacy and now owes them $425m, says court

Vera C. Rubin Observatory

The Vera C. Rubin Observatory, located on Cerro Pachón in Chile at 2,682 meters elevation, represents a revolutionary leap in astronomical observation capabilities[^1]. Set to begin operations in 2025, it will conduct the Legacy Survey of Space and Time (LSST), creating an unprecedented time-lapse record of the southern sky[^2].

Core Capabilities

The observatory centers on the 8.4-meter Simonyi Survey Telescope, equipped with the world's largest digital camera - a 3.2-gigapixel device weighing 3,000 kilograms[^3]. This camera combines 189 individual charge-coupled devices (CCDs) that deliver data within seconds of capturing an image[^7].

The telescope's unique three-mirror design provides an exceptionally wide field of view - 3.5 degrees in diameter, equivalent to about 45 full moons[^1]. Two of these mirrors, the primary (M1) and tertiary (M3), are crafted from a single piece of glass to enhance stability and rapid positioning[^1].

Scientific Mission

The observatory has four primary scientific objectives[^4]:

1. Understanding dark matter and dark energy
2. Creating an inventory of Solar System objects
3. Mapping the Milky Way
4. Exploring transient phenomena like exploding stars and black holes

Over its planned 10-year survey, Rubin will catalog approximately:

• 20 billion galaxies
• 17 billion stars
• 6 million Solar System objects
• 100,000 near-Earth objects[^1]

Data Management

The observatory will generate about 20 terabytes of data nightly[^6]. Three types of data products will be produced[^1]:

• Prompt alerts within 60 seconds of observation
• Daily processed images and catalogs
• Annual reprocessed data of the entire dataset

"For the first time in history, the number of cataloged celestial objects will exceed the number of living people!" said Željko Ivezić, director of construction[^7].

Current Status

The observatory achieved first light in April 2025, with system first light images released on June 23, 2025[^1]. Initial images revealed over 2,000 previously unknown asteroids and captured unprecedented views of the Trifid and Lagoon nebulae[^1].

Public Access

Unlike many observatories, Rubin will make its data widely available. "That's a huge democratization of science," notes Ivezić[^7]. The data will be accessible to professional astronomers, students, and the general public through various platforms and tools[^3].

[^1]: Wikipedia - Vera C. Rubin Observatory [^2]: Rubin Observatory - About [^3]: NSF - NSF-DOE Vera C. Rubin Observatory [^4]: NOIRLab - Vera C. Rubin Observatory [^6]: AURA Astronomy - Vera C. Rubin Observatory [^7]: Science News - The Vera Rubin Observatory is ready to revolutionize astronomy

A developer repurposed discarded disposable vapes into functioning web servers by utilizing their built-in PUYA microcontrollers[^1]. The project runs on a 24MHz Cortex M0+ chip with 24KiB flash storage and 3KiB RAM, found inside modern rechargeable "disposable" vapes[^6].

The web server implementation uses uIP for TCP/IP networking and communicates via SLIP protocol through semihosting. After optimizing the data transfer with ring buffers, the server achieves 20ms ping times and 160ms page load speeds[^6].

The project demonstrates creative e-waste reuse at a time when disposable vapes face increasing restrictions, with recent bans enacted in Rhode Island[^13] and other jurisdictions. The developer notes the irony of "disposable" devices containing USB-C ports and rechargeable batteries[^6].

[^1]: Hosting a WebSite on a Disposable Vape | Lobsters

[^6]: Hosting a WebSite on a Disposable Vape

[^13]: New year, new laws: RI to put host of new laws on the books | ABC6

Spotube is an open-source music streaming platform that functions as a lightweight alternative to the official Spotify client[^7]. The app allows users to stream music without requiring a Spotify Premium subscription.

Key features include:

• Ad-free listening using public Spotify and YouTube Music APIs
• Cross-platform support for mobile and desktop
• Downloadable tracks for offline listening
• Time-synced lyrics
• Anonymous/guest login
• No telemetry or user data collection
• Native performance without using Electron

A notable limitation is that Spotube can sometimes play mismatched tracks, particularly for less popular songs. Users have reported cases where the app plays incorrect versions of songs from YouTube when the original Spotify track isn't found[^5].

The app is available through:

• F-Droid for Android devices[^7]
• GitHub releases for desktop platforms^4

[^5]: GitHub - Incorrect, Mismatching Tracks Issue [^7]: F-Droid - Spotube