Link Log

Samantha Cole, 404 Media:

On the morning of December 4, five ninth grade girls, all 14 or 15 years old, showed up for class at Radnor High School. By 8 a.m. — the sun had been up for less than an hour — it felt like the entire school already heard what happened the night before. A fellow freshman boy allegedly created AI-generated sexually explicit videos of the girls using an app, and sent them to his friends. From there, word of the videos and gossip spread from teenager to teenager, school to school, until they made their way back to the girls whose faces were in the deepfakes.

[…]

The images originated from one boy, who used an app called Movely, the girls and their parents believe. The app is similar to dozens hosted in the Apple and Google app stores and advertised on Instagram and TikTok that promise to create AI images and videos of users as superheroes, animals, or influencers; behind a paywall, however, users could edit photos and videos with text prompts.

It almost goes without saying, but the “paywall” is — or was; the app has been removed — an in-app payment from which Apple takes a 15–30% cut.

Apple released its annual justification for running software distribution through the App Store — it told European regulators it actually has five, so maybe this press release only concerns the one accessible from an iPhone — and there are some big numbers in it, as usual. Apple says it “took a number of actions to block bad actors from distributing malicious software, rejecting over 2 million problematic app submissions last year alone”. This Movely app was not one of them. It was only removed after the Tech Transparency Project reported in April that App Store search terms like “nudify” and “undress” displayed results for apps that do exactly that. In its press release, Apple says it has many features for directing kids to age-appropriate apps and restricting them from downloading those which are not but, of the software found by TTP in the App Store and Google Play Store, “31 of the apps were rated suitable for minors”.

Of Movely, the TTP said in its report:

Likewise, an App Store search for “adult AI” returned an ad for Movely – AI Photo to Video. The app offers a suite of AI photo and video editing tools including a try-on feature that will replace a woman’s clothes with outfits including bikinis and lingerie. One tool allows users to select part of any photo and edit it with a text prompt. To test this feature, TTP uploaded an image of a woman in a white T-shirt standing next to a river. After using the selection tool to highlight the woman’s shirt, we entered the prompt “topless.” The app immediately generated four versions of the woman nude from the waist up. It required a paid subscription to download the AI images.

TTP could not reach Movely’s developer, FES2 Inc., for comment. Emails sent to the developer bounced back as undeliverable.

(For clarity, the TTP says it used A.I.-generated images of women to test these apps.)

The search query used to find this app, “adult A.I.”, feels like something Apple should be testing against. If it does not want porn or porn-adjacent apps in its store, it should obviously block these kinds of keywords and flag the apps which are in the results. Moreover, Apple says:

As powerful AI development tools drive a surge in app submissions, Apple’s App Review process has seamlessly scaled to handle the volume and to help ensure every new app and app update meets the App Store’s high standards for privacy, security, and quality.

The Movely app should have raised flags here, too. The developer’s website was, according to the .co whois site, registered in July 2025, and is basically a placeholder. The app’s website was registered a week earlier, and the email address in the privacy policy does not match the one in the terms of service, nor does either match the developer’s website. Also, the blog is full of posts about generating A.I. girls and changing clothes.

These red flags are not obvious in hindsight; they should have been obvious from the time this app was submitted. Meanwhile, apps from longtime and trustworthy developers like Manton Reece and Radu Dutzan are stuck in App Review for dumb and basically invalid reasons.

Betsy Powell, the Star:

Essentially spyware, an ODIT [on‑device investigative tool] can grant almost unlimited access. Investigators can capture screenshots, monitor keypresses, access emails and text messages — including those that are encrypted — and even remotely activate microphones and cameras. All without the owner knowing.

By August, police announced 23 arrests, 279 charges, and more than $9 million in recovered vehicles.

But the case has also done something else: It has pulled back the curtain on how police forces in Ontario — not just in Windsor, but in Toronto and Peel Region — are now using these powerful technologies to reach deep inside suspects’ devices. And despite ODITs growing use in major prosecutions in the province, government lawyers and police are fighting tooth and nail to keep almost everything about them secret: how they work; what safeguards, if any, govern their use; even the names of the companies that sell them.

The details of this report align with research published last year by Citizen Lab about Paragon’s Graphite spyware, including a likely link to the Ontario Provincial Police. It is not the only police force in Canada using ODITs, either. In 2022, the RCMP acknowledged its own use; Christopher Parsons, a civil rights advocate and director at the Information and Privacy Commissioner of Ontario, keeps a small library of related policies.

Jon Keegan, of Robinhood’s Sherwood News:

A Sherwood News analysis shows that the breaks afforded to Meta on just the sales tax of GPUs would come out to more than $3.3 billion — enough to build 33 new high schools, pay the salaries of all the state’s public school teachers for more than a year, or pay for more than seven years of the Louisiana State Police budget. (The secretary from the Parish committee that approved the financing plans declined to comment, and the chair of the committee didn’t respond to requests for comment.)

This is the very same project where Jonathan Weil, of the Wall Street Journal, found “aggressive accounting” that “strains credibility”. Neither of these advantages would be possible for a less-resourced competitor. Meta is a company so rich it benefits immensely without carrying nearly as much risk as the scale of this project would imply.

Justin Ling, the Star:

Yet Bill C-22 doesn’t mandate backdoors nor force companies to introduce any. It explicitly states the government cannot compel companies to introduce “systemic vulnerability” into their services. And it doesn’t give cops or spies new authority to intercept Canadians’ communications; it simply creates a process enlisting companies to help out with doing so.

Ottawa is now scrambling to correct the record. Anandasangaree will reply to the Republicans, conveying “this legislation does not provide for indiscriminate access to devices or communications and does not require companies to weaken encryption and introduce so-called ‘backdoors,’” according to a spokesperson. (The U.S. and the U.K., they also noted, already have these powers; Signal hasn’t withdrawn from either country.)

So the bill is not quite the nightmare some have made it out to be. But there are still some big issues.

Whether Signal is crying wolf or simply believes the laws in those countries are strong enough to prevent mandated backdoors is a good question. In the U.K., for instance, Ofcom is not allowed to require a backdoor, but it is empowered to tell providers to weaken encryption for some without compromising the privacy of their platforms for all when “feasible technology” exists to do so. On the one hand, that technology probably cannot exist; on the other hand, Signal is banking on a privacy-friendly interpretation of that law if it is ever tested.

Apple, meanwhile, has not returned Advanced Data Protection to the U.K. despite the U.S. Director of National Intelligence’s claim that efforts to compromise its encryption have been withdrawn. This demand was made under a different law that, I suppose, Signal must not feel is immediately threatening.

Bill C–22 does, as Ling writes, provide an exemption for instances where compliance with interception demands would “require the provider to introduce a systemic vulnerability related to that service or prevent the provider from rectifying such a vulnerability”. This is the same language as appeared in the Strong Borders Act proposed last year, though C–22 has new powers requiring the retention of metadata. It seems to me that a systemic vulnerability — one that “creates a substantial risk that secure information could be accessed by a person who does not have any right or authority to do so”, according to this bill — might not be found in something like metadata retention, which is what apparently concerns Signal.

Peter Shamshiri:

The answer is that there’s an entire genre of media coverage best described as “rich guy has an opinion.” It’s surprisingly common, and once you notice it you’ll see it everywhere: entire news stories dedicated to the otherwise unremarkable opinion of a rich person, or news stories that fold the opinions of rich people into their otherwise neutral coverage. It’s taken for granted in many newsrooms that a person’s wealth imbues their opinions with newsworthiness.

Karl Bode has called this “CEO Said a Thing! journalism”, and it is all over the place. I think Shamshiri’s broader definition is useful, too, especially in lower-stakes situations.

This week, for example, the Calgary Herald published a whole entire article dedicated to the complaints of a local landlord about a new protected bike lane. She is quoted as saying “[t]here will be no parking whatsoever for any of the businesses that are already here” below a photograph of her standing in front of the large parking lot, which will remain unchanged following the bike lane upgrades. The only other person apparently interviewed for the article is the area’s councillor. This is just one wealthy person’s grievances treated as inherently newsworthy.

Madeline Batt, Tech Policy Press:

The recent lawsuit Noel v. Perplexity brought the question of AI monetization onto a courthouse docket. Since voluntarily dismissed by the plaintiff, the details of the class action provided a window into how adtech in AI is likely to be challenged in the courts.

The lawsuit targeted generative AI company Perplexity, along with Meta and Google, alleging they disclosed transcripts of users’ conversations with chatbots for targeted advertising. […]

It is not clear to me why the anonymous plaintiff gave up on this case. Abandoning the suit does not necessarily mean its claims are unfounded.

Maggie Harrison Dupré, Futurism:

A new class action lawsuit accuses OpenAI of sharing data including user chat queries and personal identifying information like emails and user IDs with the tech giants — and targeted advertising behemoths — Meta and Google, without obtaining proper user consent.

Interestingly, the Office of the Privacy Commissioner of Canada recently concluded an investigation of OpenAI’s training on personal information and whether it can produce that information reliably. It seems to me like questions about third-party ad targeting were out of scope. This is notable, however:

OpenAI represented that ‘untraining’ or ‘reverse-training’ LLMs, so that they no longer use or generate specific personal information for which a deletion request has been submitted, is not currently feasible. OpenAI explained that this is because its models are trained through repeated adjustments of billions of weights (parameters) over successive runs of training datasets and do not contain or store copies of information that they ‘learned’ from.

I think we all knew this was the case, but it underscores the questionable effectiveness of robots.txt rules for website owners wishing to opt out of being a source for LLM training. It is not even clear OpenAI, for example, ensures data in its collection remains in compliance with opt-out requests when training new models.

Marie Woolf, the Globe and Mail:

Secure messaging service Signal, which uses end-to-end encryption, is warning it would withdraw from Canada if asked to compromise its users’ privacy under Bill C-22, Ottawa’s proposed lawful access legislation.

[…]

The bill would require “core providers” — which would later be defined through regulations — to retain metadata for up to a year.

Are lawmakers capable of learning from their peers elsewhere? Do we have to do this kind of thing every year, country-by-country?

Jason Koebler, 404 Media:

To browse the internet today, to consume any sort of content at all, is to be bombarded with AI of all sorts. People think things that are fake are real, things that are real are fake. Much has been written about “AI psychosis,” the nonspecific, nonscientific diagnosis given to people who have lost themselves to AI. Less has been said about the cognitive load of what other people’s AI use is doing to the rest of us, and the insidious nature of having to navigate an internet and a world where lazy AI has infiltrated everything. Our brains are now performing untold numbers of calculations per day: Is this AI? Do I care if it’s AI? Why does this sound or look or read so weird? Does this person just write like this? Is this a person at all?

I imagine there are some people who do not much care if the news article they are reading or the music they are listening to was generated by A.I. — with or without their knowledge. I think it feels cheap and shameful. There are interesting uses for generating material based on known patterns and structures but we are stuck with a bunch of spam, and it makes everything feel inherently suspicious. Perhaps that is in some way a good thing; we should be more careful, in general. I think Koebler captures the feeling of being on constant high alert, and living in an increasingly artificial and scam-filled world.

Maybe you are in the market for a great Bluesky client. Maybe you are in the market for a great Mastodon client. Maybe you are in the market for a combination great Bluesky and Mastodon client.

Aaron Vegh:

Today, Ben McCarthy and I are launching Indigo. It’s a full-featured client for both Mastodon and Bluesky, available on iPhone, iPad and macOS. Go get it on the App Store!

I have been using Indigo for a while as my primary iOS client for Bluesky and Mastodon, and I think it is terrific. I would happily use it as a standalone app for either. Mixing the two services in one app, though, is better than I had imagined. Everything feels right: posts are colour-coded, you can reply with either account, and there are clever ways of handling existing cross-posting.

Ben McCarthy:

Indigo will automatically detect when a post is duplicated across both networks. If the content is very similar and they both appear within a few minutes as each other, Indigo will merge them so you’re not seeing them twice. You can toggle between each version as well as perform actions like quoting or replying to both posts simultaneously. We’ve done a lot to make the experience of using two different services at once feel seamless.

This kind of app might not work for everyone. I understand the arguments for treating these worlds entirely differently. For me, though, this is a little bit like how I prefer reading email newsletters in my RSS app: my brain is not differentiating between articles on a website and articles sent by email when I just want to read all the new articles. Likewise, I am rarely thinking I need to check Bluesky or I need to check Mastodon; I am usually just in the mood to scroll through or post on social media. Indigo scratches that itch.

There is a caveat. Though Indigo supports multiple accounts of each type, only one of each can be active at a time. This makes sense and, I expect, would have no impact for most people. For those of us with accounts for different purposes, however, it does mean it is slightly more cumbersome than the way account switching typically works in a single-service client. This is, for me, a reasonable compromise.

Open standards are pretty great, hey?

On 14 April, Matina Stevis-Gridneff, the New York Times’ Canada bureau chief, quoted Pierre Poilievre, leader of the Conservative Party, calling the spate of floor crossersturncoats”. He apparently said this — and more — in a speech in March. This was printed on page A7 and sat for weeks on the web until 1 May when the Times corrected the paragraph by using actual quotes from Poilievre’s speech in April, not March.

Those earlier quotes? According to the editor’s note appended to the bottom, it was “an A.I.-generated summary of his views about Canadian politics that A.I. rendered as a quotation”.

The WalrusMichelle Cyca, on Bluesky [sic]:

personally I think it’s a very big deal that the Canada bureau chief for the @nytimes.com — certainly one of the highest-paid journalists in the country — asked an unspecified “AI tool” what Poilievre said & published its AI-hallucinated quotes in her reporting.

Cyca is not kidding about the pay. The Times is currently hiring a Western Canada correspondent with a base pay of between $158,000 and $235,000 Canadian; the bureau chief is surely a pay grade above that. For comparison, the Globe and Mail is hiring an Ottawa bureau chief with a maximum posted salary of $146,000.

How much more would the Times need to pay a reporter to verify the quotations they use in an article? Could the Times afford an editor to double-check these things? I was at an event this evening about A.I. and art, and one of the panelists — a university professor — said that he assumes that A.I. is now omnipresent and acts accordingly. Why is one of the most prestigious English-language newspapers not doing the same for its reporters, regardless of its policies?

Jay Peters, the Verge:

Venmo is starting to test a big redesign of its app, and as part of the changes, it will be implementing a major new privacy measure: the onboarding process for new users will set their posts to only be viewable by their friends by default instead of being public.

I remain too dumb to understand why you would want financial transactions to be visible to anyone but yourself.

Kelsey Piper, the Argument:

At some point, pretending that how people use AI is a complete mystery is just lying to your audience. And at some point, [Ed] Zitron’s “layers of skepticism” attitude — where he is skeptical that AI is a thing at all, that it has any uses, that those uses provide any economic value, that the revenue numbers are real, that adoption is a fad, that training costs are a meaningful R&D expense, that the capital build-out is going to happen at all, that the market could sustain the capital build-out if it happened — leaves one buried in too many impossibility assertions to actually sort them by plausibility.

It is radical skepticism, ultimately arriving at “perhaps nothing we see is real,” rather than principled skepticism about the relatively weakest links in the companies’ case for investment.

My main problem with this piece is that it acknowledge Zitron’s own framing as an A.I. skeptic when he is not one. A skeptic is someone who asks good-faith questions and uses the answers to build an evidence-based view of something. They can separate reasoning from a narrative, while understanding the role it plays. For example, I do not regularly read the Argument because I think it a pretty mediocre website with an Atlantic-lite viewpoint, but that does not mean this article is itself poor or making an unfair case. I think Piper’s frustration with Zitron is entirely earned. However, it is a mistake to think of any of this in terms of skepticism when Zitron’s understanding is, especially now, much closer to conspiracy thinking.

Each of Zitron’s articles is an impenetrable wall of text often reaching into the tens of thousands of words. This volume of material feels substantial — it can be substantial — to the extent Zitron explicitly markets his newsletter on the basis of its word count. Weird.1 He explores basically two major themes: A.I.’s economic case, and its usefulness. Zitron is zealously opposed to the possibility of either in real terms; while he will occasionally gesture at people or businesses doing something with A.I., his default position is more-or-less that it has little use.

There are real criticisms of what generative A.I. does: problems with its output, like its repetition of stereotypes or bugs in code. There are criticisms for what it does to our world, like its energy and water consumption, and what it does to society, like how easy it is to generate junk articles and videos. The societal pushback is also notable, and its unethical foundations continue to be a ripe source of pain. But, as Piper writes in the second footnote, Zitron’s articles are “a superficiality of analysis” despite the voluminous output. Like a lot of conspiracy thinking, they are rooted in fact but have a stricter adherence to supporting an existing narrative.


  1. While I am writing about adequate skepticism, I am unsure of the apparent attention span crisis. We seem to be constantly circulating multi-thousand-word essays, barely-edited podcast episodes, and hours-long YouTube videos. People spend real time with media — a long time. Sometimes, a generous runtime is what it takes to make an argument; often, though, I think it becomes a filter for separating the committed from the not. And, then again, maybe extra-long takes the bubble I am in. ↥︎

Do you want to block ads and trackers across all apps on your iPhone, iPad, Mac, or Apple TV — not just in Safari?

Then download Magic Lasso Adblock – the ad blocker designed for you.

Sponsor: Magic Lasso Adblock

The new App Ad Blocking feature in Magic Lasso Adblock v5.0 builds upon our powerful Safari and YouTube ad blocking, extending protection to:

  • News apps

  • Social media

  • Games

  • Other browsers like Chrome and Firefox

All ad blocking is done directly on your device, using a fast, efficient Swift-based architecture that follows our strict zero data collection policy.

With over 5,000 five star reviews, it’s simply the best ad blocker for your iPhone, iPad, and Mac.

And unlike some other ad blockers, Magic Lasso Adblock respects your privacy, doesn’t accept payment from advertisers, and is 100% supported by its community of users.

So, join over 400,000 users and download Magic Lasso Adblock today.

Chris Iorfida, CBC News:

A Canadian is fighting back in U.S. federal court over what he says is an attempt by the Department of Homeland Security, through Google, to seek “vast swaths of information” about his personal life following social media posts critical of Donald Trump’s administration.

[…]

On Jan. 30, the Canadian X user disparaged ICE in a post that received nearly 96,000 views, according to this week’s complaint.

[…]

The complaint at hand, however, states that John Doe was not seeking entry to the U.S. and has not done so since 2015.

The only details we have of this case are as alleged in the complaint (PDF) and the partially redacted summons (PDF), and they are incomplete. The tweet in question is not quoted, the account is not named, and, though there are enough clues that I tried to track it down, X’s search feature sucks, so I have no idea what it said. Perhaps there is another reason the Department of Homeland Security is trying to obtain details of the Gmail account; perhaps, too, the government was not aware it was targeting a Canadian. (Though, if it were targeting a U.S. resident for their speech, is that any better? Probably not!)

One thing that remains unclear is how the government obtained this email address. Iorfida writes of a previous case:

In the first Trump administration, CBP issued a summons to Twitter in 2017 requesting information regarding the account of a user on Twitter, which the company objected to.

It would be unsurprising if X was entirely compliant with the government’s request.

What is shocking to me is that the U.S. government is apparently going after someone whose X posts, according to the complaint, “have received tens of thousands of views or more; collectively, his posts have received well over 100,000 views”, and this single tweet might represent around half that total. I do not intend to be mean, but those are not the numbers of a notable X account. Officials in the most powerful country in the world are apparently going after some random Canadian for an unmemorable and basically unpopular tweet.

Nate Anderson, Ars Technica:

The block seemed curious, given that Reddit began as a website, and websites generally want traffic. Few are in the practice of turning traffic away.

But some services, including X and Instagram, aggressively push users toward apps—or at least toward being logged in to them.

I reached out to the company to ask what was going on. According to a spokesperson, “We recently started running a test for a small subset of frequent logged-out mobile users that prompts them to download the app after visiting the site. These users are already familiar with Reddit and we’ve seen that the experience is much better for them in the app. The app offers a more personalized experience and users can more easily find communities that match their interests.”

Like other major social media platforms, this turns Reddit into a walled garden. Presumably, this is in part of the company’s aggressive strategy to license users’ posts for A.I. training, plus encouraging user growth. It sucks that the open web is getting torn apart because commercial websites are incentivized to direct people to apps where large-scale scraping is a bigger challenge. This whole thing used to feel so quaint.

Samantha Cole, 404 Media:

Aylo, the parent company of Pornhub and other major porn sites, announced today that in the UK, iPhone and iPad users will be able to access its sites again, ending an over three month ban that Aylo initially enacted because of the region’s age verification law.

As of Tuesday, following the iOS 26.4 rollout in the UK, users on the new operating system can visit Pornhub and Aylo’s other sites from their iPhones.

Frustratingly, there is no explanation as to how Aylo’s websites are getting information from this iOS 26.4 API, the documentation for which is only for native apps. I may have missed something obvious, but the only mention I could find of this capability is in a February AppleInsider article. Also I could not find a way to trigger this verification step, even after changing my iPhone’s region, so I cannot test whether it is being passed through an HTTP header — which I presume it is — or another method.

Marie Woolf, the Globe and Mail:

In a letter to Public Safety Minister Gary Anandasangaree and Justice Minister Sean Fraser, the Canadian Chamber of Commerce says that, as currently drafted, Bill C-22 “presents considerable risks to Canadian businesses, investment and the integrity of data systems.”

[…]

But the letter expresses concern that, as currently worded, the bill could be used to “require companies to create a back door, which would place encrypted systems at risk.” It says Canada should embrace strong encryption to catalyze growth of the Canadian tech sector.

Under the previous parliamentary session, the Consumer Privacy Protection Act was halted after 136 committee meetings. The current Canadian government is still arguing for updates to the Privacy Act, even as it pushes this hostile bill, but it has not resumed efforts to pass the CPPA.

Dan Friesen, writing on the “Knowledge Fight” Patreon page:

As discussed in today’s podcast episode, Dan and Jordan have decided that they had reached what they felt was the end of the show.

Sometimes, periodical media is created with an elaborate plan or story arc. Often, though, there is no predetermined structure and, especially in the case of reactive or commentary media, the next entry feels almost inevitable. Until it stops. Then we get to feel what our world is like without it and, if it leaves a void, it is a sign it was valued. The end of “Knowledge Fight” leaves a big void.

I will miss this show deeply. Friesen has a particular knack for assessing the world of Alex Jones and other conspiracy broadcasters as what they are: performers. Horrible and dangerous people, to be sure, but acting primarily in service of a performance. Holmes, his co-host, was a good foil for this show in his pure reaction to the inherent horror in this media. If everything goes to plan, a recording of an upcoming live show will be out later this month, and then it is done. What a run.

Do you want an all-in-one solution to block ads, trackers, and annoyances across all your Apple devices?

Then download Magic Lasso Adblock — the ad blocker designed for you.

Sponsor: Magic Lasso Adblock

With Magic Lasso Adblock you can effortlessly block ads on your iPhone, iPad, Mac, and Apple TV.

Magic Lasso is a single, native app that includes everything you need:

  • Safari Ad Blocking — Browse 2.0× faster in Safari by blocking all ads, with no annoying distractions or pop ups

  • YouTube Ad Blocking — Block all YouTube ads in Safari, including all video ads, banner ads, search ads, plus many more

  • App Ad Blocking — Block ads and trackers across the news, social media, and game apps on your device, including other browsers such as Chrome and Firefox

  • Apple TV Ad Blocking — Watch your favourite TV shows with less interruptions and protect your privacy from in-app ad tracking with Magic Lasso on your Apple TV

Best of all, with Magic Lasso Adblock, all ad blocking is done directly on your device, using a fast, efficient Swift-based architecture that follows our strict zero data collection policy.

With over 5,000 five star reviews, it’s simply the best ad blocker for your iPhone, iPad, Mac, and Apple TV.

And unlike some other ad blockers, Magic Lasso Adblock respects your privacy, doesn’t accept payment from advertisers, and is 100% supported by its community of users.

So, ensure your browsing history, app usage, and viewing habits stay private with Magic Lasso Adblock.

Join over 400,000 users and download Magic Lasso Adblock today.