Medieval Iron, Survivorship Bias and Modern Metallurgy

When you hear it said that “Modern steel is disposable by design”, your ears perk up, as you just caught the unmistakable sound of faux romanticism along with ‘lost ancient technology‘ vibes. Although it happens sometimes that we did lose something important, as with for example the ancient Roman concrete that turns out to have self-healing properties as a result of so-called hot mixing, this is decidedly an exception.

We nearly lost that technology because of the technological and scientific bonfire that was the prelude to a thousand years of darkness over Europe: called the Dark Ages, Middle Ages as well as the medieval period. Thus when you come across a slideshow video with synthesized monotonal voice-over which makes the bold claim that somehow medieval iron was superior and today’s metallurgy both worse and designed to break, you really have to do a spit-take. The many corrections in the comment section further reinforces the feeling that it’s more slop than fact.

One of the claims made is that the bloomery furnace beats the blast furnace, due to beneficial additives to the iron. Considering that the video cites its sources, it’s at least worthy of a dive into the actual science here. Are modern iron and steel truly that inferior and disposable?

The Iron Age

Han Dynasty iron sickle and plow. (Credit: Gary Todd, Wikimedia)
The Iron Age is defined as the point when a civilization begins to mass-produce tools and weapons made from processed iron ore rather than just the use of found meteoric iron. What makes this such a telling technological moment is because in order to smelt iron, you need to have a furnace capable of generating temperatures around 1,250 °C. The transition between the easier to process bronze and superior iron took place between 1,200 and 1,100 BCE in Europe, along with much of Asia, in particular India and China.

Processing iron ore to turn it into any of the types of iron alloys possible can be done in a variety of ways, with direct reduction through smelting commonly being used throughout history, alongside blast furnaces. These latter became the most common approach in the 20th century, using a two-stage process involving refining in a converter. Electric arc furnaces can take both the pig iron from blast furnaces and scrap metal as input. Regardless of the method used, the iron ore has to have its impurities removed or reduced to the desired levels for the target alloy.
Bloomery smelting during the Middle Ages, as depicted in the De Re Metallica by Georgius Agricola, 1556 (Source: Wikimedia)
Pig iron is the output of blast furnaces and can be used for cast iron when melted. This is different from the wrought iron, which traditionally was produced using the output from a bloomery. This is a type of metallurgical furnace capable of smelting iron ore. Using direct reduction with a reduction gas like carbon monoxide, methane or hydrogen, it produces direct reduced iron, also called sponge iron, with the intended reduction in carbon content. This can then be processed by a blacksmith into wrought iron products.

Blast furnaces also provide this carbon reduction, using coke or hydrogen as the redox agent, but as a continuous process the resulting pig iron has a carbon content of 3.8 – 4.7% compared to the higher purity of direct reduced iron that puts it on the level of scrap steel.

Currently blast furnaces and electric arc furnaces offer the most economical way to produce large amounts of steel. Modern direct reduction furnace types have been developed that while not directly competitive have certain advantages, such as being able to process certain ore types that blast furnaces struggle with.

That said, China in particular focused significantly on blast furnaces, with no significant use of bloomeries, but instead the use of finery forges to refine the pig iron from their blast furnaces. By using water power, the blast furnaces could produce massive amounts of pig iron, giving China a significant advantage over medieval Europe.

Archaeometallurgy

The Iron pillar of Delhi, erected around 400 CE. (Credit: Sujit Kumar, Wikimedia)
So how did medieval iron alloys differ from that during the early days of the Iron Age in Europe and China, never mind during the technological boom of the ancient Roman Empire? Unsurprisingly the Early Middle Ages (500 – 1000 CE) saw mostly a sharp decline in mining and metallurgy that took until the High Middle Ages (11th to 13th centuries) to begin to recover and the Late Middle Ages to see a strong push for innovation. This was however not an easy period, as famine, war and pestilence kept ravaging economies and its people. Compared to the relative peace and structured society of the Roman times, things couldn’t have been more different.

The study of metallurgy from a historical context is called archaeometallurgy, which focuses on observable evidence such as slag and similar residues left over at former furnace and blacksmithing sites, as well as found metal artefacts. This latter aspect of found artefacts bears reminding, as these include the iron objects that survived often being buried for hundreds if not thousands of years. This risks indulging in survivorship bias, as we do not recover iron artefacts that did rust away, nor those that were tossed with other scrap metal into a furnace.

The iron pillar of Delhi is one such example. This six-ton, 7.21 m tall behemoth has drawn significant attention for its lack of corrosion despite having been exposed to the elements for more than a thousand years. After study of this pillar and other examples of Indian iron from roughly the same era, the levels of phosphor (P) were implicated in the formation of a corrosion resistant hydrate layer, as summarized in a 2000 article by R. Balasubramaniam in Corrosion Science. This is however a relatively thin and fragile layer. Before a protective cage was added, the constant touching of visitors would affect this layer, explaining why its bottom is rather rusty.

What this does however highlight is the importance of a passivation element in iron alloys to enable some level of corrosion resistance by preventing or slowing down the oxidation process. This, combined with environmental factors such as dry air and a low-oxygen environment can be key to the survival of an iron object.
Spanish medieval gilded spur. 13th – 15th century as found (a) and preserved (b) (Credit: Marco Veneranda et al., 2016)
In the case of modern stainless steel, this passivation is provided primarily by chromium which helps form a protective layer. As pre-Industrial Revolution iron alloys tended to have significant amounts of slag and other contaminants embedded in them, this provided enough opportunities for such a passivation layer to be formed.

A good study subject when it comes to medieval iron can be found in the surviving medieval structures, which are primarily churches and cathedrals. These have iron reinforcements that are exposed to various environments, ranging from an dry indoor climate to ones more conducive to corrosion. In a study of these iron rebars in the 13th century Bourges’ Cathedral attic, including a broken one, it was found that they were decidedly rusting away and that even these primarily indoor rebars need special preservation techniques to keep them from eventually failing.

During an excavation in a medieval necropolis in Spain, a gilded spur was uncovered. This was used for an experimental archaeological analysis method, detailing just how far this gilded, medieval iron object was decayed. While the gold layer provided some protection against corrosion, eventually moisture and oxygen managed to make its way past this layer and over the course of a few hundred years much of the spur decayed to the point where it was largely falling apart.

Modern Age

Although it’s tempting to hold modern day in contempt and indulge in romanticism of a past that never was, the fact of the matter is that these days we have ways to analyze and manipulate iron and other alloys in ways that the ancient Romans and medieval metallurgists could only dream of. While they had extensive institutional knowledge based on empirical findings, we can use methods like Raman spectroscopy to prod molecules to determine their identity and electron microscopes to find out their structure.

Whereas for ancient Roman concrete we can definitely state that it’s better in certain ways than the concrete we have been using since the Industrial Revolution, there we have the hard to miss evidence of Roman concrete structures like ancient seawalls and the Pantheon in Rome seemingly oblivious to the elements and weather of the past two thousand-odd years.

As far as miraculous ancient iron goes, there are definitely a few oddities out there like certain types of Indian iron, and using modern metallurgy we should definitely do our utmost to understand the materials science behind their longevity. That said, modern metallurgy is already pretty good. If your tools are rusting away, or your stainless steel car is taking on a disquieting orange sheen, you probably should have picked that 304 stainless steel instead of cheapening out with a 200-series or 301 stainless steel. We have the technology.

hackaday.com/2025/11/05/mediev…

Un pericoloso Exploit Zero-day Zero-click minaccia miliardi di device Android

Google ha emesso un avviso urgente riguardante una vulnerabilità critica in Android che consente agli aggressori di eseguire codice arbitrario sul dispositivo senza alcuna interazione da parte dell’utente. La vulnerabilità Zero Click è stata scoperta in componenti di sistema del sistema operativo e descritta nel Bollettino sulla sicurezza Android di novembre 2025.

La vulnerabilità, identificata come CVE-2025-48593, è considerata una delle più pericolose degli ultimi anni. Colpisce diverse versioni dell’Android Open Source Project (AOSP), dalla 13 alla 16, e può essere sfruttata per l’esecuzione di codice remoto ( RCE ) senza richiedere privilegi aggiuntivi o azioni da parte del proprietario del dispositivo.

Google stima che gli aggressori possano sfruttare il bug inviando pacchetti di rete appositamente creati o distribuendo app dannose tramite store di terze parti e installazioni sideloaded. Un attacco riuscito consente l’accesso completo al dispositivo, inclusa la possibilità di rubare dati, installare ransomware o trasformare lo smartphone in un componente botnet. Il problema è stato registrato internamente con l’ID bug Android A-374746961 ed è già stato risolto nelle ultime build di AOSP.

La vulnerabilità deriva da una gestione impropria dei processi di sistema, che consente l’iniezione di codice arbitrario durante le normali operazioni, ad esempio durante l’avvio di app o la sincronizzazione dei dati in background. I ricercatori osservano che i sintomi della vulnerabilità sono simili a quelli di precedenti episodi di danneggiamento della memoria utilizzati per aumentare i privilegi sul dispositivo.

Il bollettino identifica anche un’altra vulnerabilità, il CVE-2025-48581. È classificata come vulnerabilità di escalation dei privilegi (EoP) di gravità elevata ed è presente anche nel componente di sistema. A differenza dell’RCE, lo sfruttamento richiede un accesso preventivo al sistema, ma consente a un’applicazione di ottenere il controllo non autorizzato di funzioni sensibili del dispositivo.

I dispositivi con Android 10 e versioni successive potranno ricevere aggiornamenti di sicurezza, ma i possessori di modelli precedenti rischiano di rimanere senza protezione se i produttori ritardano il rilascio delle patch. Google consiglia a tutti gli utenti di verificare la presenza di aggiornamenti il prima possibile tramite Impostazioni > Sistema > Aggiornamento di sistema e di impostare il livello di patch di sicurezza al 2025-11-01, che risolve completamente questi problemi.

L’azienda sottolinea che non sono stati ancora registrati exploit attivi, ma la natura della vulnerabilità la rende particolarmente pericolosa per il governo e le personalità pubbliche, che sono spesso bersaglio di attacchi mirati.

La frammentazione di Android rimane un problema chiave nell’ecosistema, rendendo le risposte tempestive dei produttori fondamentali per la protezione degli utenti. Gli esperti raccomandano di abilitare gli aggiornamenti automatici ed evitare di installare app da fonti non attendibili: questo rimane il modo più affidabile per ridurre al minimo i rischi in un contesto di crescente minaccia per dispositivi mobili.

L'articolo Un pericoloso Exploit Zero-day Zero-click minaccia miliardi di device Android proviene da Red Hot Cyber.

L’era dei Paywall è finita? I Browser intelligenti l’aggirano e controllarli è molto difficile

Come possono gli editori proteggersi dai browser “intelligenti” dotati di intelligenza artificiale se hanno l’aspetto di utenti normali? L’emergere di nuovi browser “intelligenti” basati sull’intelligenza artificiale sta mettendo in discussione i metodi tradizionali di protezione dei contenuti online.

Il browser Atlas di OpenAI, recentemente rilasciato, così come Comet di Perplexity e la modalità Copilot di Microsoft Edge, stanno diventando strumenti in grado di fare molto più che visualizzare pagine web: svolgono attività in più fasi, ad esempio raccogliendo informazioni di calendario e generando briefing per i clienti basati sulle notizie.

Le loro capacità stanno già ponendo serie sfide agli editori che cercano di limitare l’uso dell’intelligenza artificiale nei loro contenuti. Il problema è che tali browser sono esteriormente indistinguibili dagli utenti normali.

Quando Atlas o Comet accedono a un sito, vengono identificati come sessioni standard di Chrome, non come crawler automatici. Questo li rende impossibili da bloccare utilizzando il protocollo di esclusione dei robot, poiché bloccare tali richieste potrebbe contemporaneamente impedire l’accesso agli utenti normali. Il rapporto “State of the Bots” di TollBit osserva che la nuova generazione di visitatori AI è “sempre più simile a quella umana”, rendendo più impegnativo il monitoraggio e il filtraggio di tali agenti.

Un ulteriore vantaggio per i browser basati sull’intelligenza artificiale è il modo in cui sono strutturati gli abbonamenti a pagamento moderni. Molti siti web, tra cui MIT Technology Review, National Geographic e il Philadelphia Inquirer, utilizzano un approccio lato client: l’articolo viene caricato per intero ma viene nascosto dietro una finestra pop-up che offre un abbonamento. Mentre il testo rimane invisibile agli esseri umani, è accessibile all’intelligenza artificiale. Solo i paywall lato server, come quelli di Bloomberg o del Wall Street Journal, nascondono in modo affidabile i contenuti fino a quando l’utente non effettua l’accesso. Tuttavia, se l’utente ha effettuato l’accesso, l’agente di intelligenza artificiale può leggere liberamente l’articolo per suo conto.

OpenAI Atlas ha ricevuto il testo completo di un articolo esclusivo per gli abbonati da MIT Technology Review (CJR).

Durante i test, Atlas e Comet hanno estratto facilmente il testo completo delle pubblicazioni classificate del MIT Technology Review, nonostante le restrizioni imposte da crawler aziendali come OpenAI e Perplexity.

In un caso, Atlas è anche riuscito a riassemblare un articolo bloccato di PCMag combinando informazioni provenienti da altre fonti, come tweet, aggregatori e citazioni di terze parti. Questa tecnica, soprannominata “digital breadcrumb”, è stata precedentemente descritta dallo specialista di ricerca online Henk van Ess.

OpenAI afferma che i contenuti visualizzati dagli utenti tramite Atlas non vengono utilizzati per addestrare i modelli, a meno che non sia abilitata la funzione “Memorie del browser”. Tuttavia, “ChatGPT ricorderà i dettagli chiave delle pagine visualizzate”, il che, come ha osservato Jeffrey Fowler, editorialista del Washington Post, rende l’informativa sulla privacy di OpenAI confusa e incoerente. Non è ancora chiaro in che misura l’azienda utilizzi i dati ottenuti tramite contenuti a pagamento.

Si osserva un approccio decisamente selettivo: Atlas evita di contattare direttamente i siti web che hanno intentato cause legali contro OpenAI , come il New York Times, ma cerca comunque di aggirare il divieto compilando un riassunto dell’argomento da altre pubblicazioni – The Guardian, Reuters, Associated Press e il Washington Post – che hanno accordi di licenza con OpenAI. Comet, al contrario, non mostra tale moderazione.

Questa strategia trasforma l’agente artificiale in un intermediario che decide quali fonti sono considerate “accettabili”. Anche se l’editore riesce a bloccare l’accesso diretto, l’agente sostituisce semplicemente l’originale con una versione alternativa degli eventi. Questo altera la percezione stessa dell’informazione: l’utente riceve non un articolo, ma un’interpretazione generata automaticamente.

I browser basati sull’intelligenza artificiale non hanno ancora raggiunto un’ampia diffusione, ma è già chiaro che le barriere tradizionali come i paywall e il blocco dei crawler non sono più efficaci. Se tali agenti dovessero diventare il mezzo principale per leggere le notizie, le case editrici dovranno trovare nuovi meccanismi per garantire la trasparenza e il controllo su come i loro contenuti vengono utilizzati dall’intelligenza artificiale.

L'articolo L’era dei Paywall è finita? I Browser intelligenti l’aggirano e controllarli è molto difficile proviene da Red Hot Cyber.

Collaboratore allontanato da Agenzia Nova per domanda scomoda: la solidarietà di Stampa Romana a Gabriele Nunziati

Allontanato dalla testata per cui si lavora per aver fatto una domanda scomoda durante una conferenza stampa. È quello che è accaduto a Gabriele Nunziati collaboratore dell’Agenzia Nova da Bruxelles. La colpa del collega è stata chiedere alla portavoce della Commissione dell’UE Paola Pinho se ritenesse che anche Israele a Gaza, come la Russia in Ucraina, dovesse farsi carico della ricostruzione. Pinho ha risposto con un imbarazzato no comment, rimbalzato sui social. Imbarazzo condiviso dall’editore di Nova Fabio Squillante, che ha interrotto il rapporto di collaborazione con Nunziati, cui va tutta la solidarietà di Stampa Romana. È un episodio gravissimo di lesione dell’autonomia professionale, che evidenzia ancora una volta la necessità di maggiori garanzie contrattuali per i collaboratori, i più esposti a pressioni e ingerenze.

La Segreteria dell’ASR

dicorinto.it/associazionismo/c…

ИГИЛ и ХАМАС поздравили Мамдани с победой

Это всё, что любому здравомыслящему человеку нужно знать о выборах мэра Нью Йорка

Europe's 'Jekyll and Hyde' tech strategy

WELCOME BACK TO DIGITAL POLITICS. I'm Mark Scott, and have partnered with YouGov and Microsoft for a dinner in Brussels on Dec 10 to recap the digital policymaking highlights of 2025 and to look ahead to what is in store for next year.

If you would like to attend, please let me know here. The event will include exclusive insight from YouGov on Europeans' attitudes toward technology. Spaces are limited, so let me know asap.

— November will again show how much the European Union is split over the bloc's strategy toward technology.

— The annual climate change talks begin in Brazil on Nov 10. The tech industry's impact has gone from bad to worse.

— Big Tech firms have massively increased their spending on tech lobbying within the EU institutions. Here are the stats.

Let's get started:

IT'S THE EU, AND IT'S HERE TO HELP

IT'S GOING TO BE A BUSY MONTH. On Nov 18, France and Germany will gather officials, industry executives and (just a few) civil society groups in Berlin for the so-called "Summit on European Digital Sovereignty." The one-day conference (as well as a series of side events) is aimed at figuring out what the European Union's position on the topic should be — despite more than five years since the concept of digital sovereignty started during the rounds in Brussels.

Then, on Nov 19, the European Commission is expected to announce its so-called "Digital Omnibus," or Continent-wide effort to simplify the bloc's tech rules, primarily focused around the Artificial Intelligence Act, General Data Protection Regulation, Cybersecurity Act and the ePrivacy Directive. It's a response to the competitiveness report written by Mario Draghi, the former Italian prime minister, which suggested (without much evidence) that Europe's complex digital rulebook was a major reason why the Continent had failed to compete with the likes of China and the United States.

The one-two punch of the Digital Sovereignty summit and the Digital Omnibus represent the two countervailing strategies toward technology that are battling for supremacy in Brussels and other EU member capitals.

There's a long history about why France and Germany still don't see eye-to-eye on digital sovereignty. Paris would prefer to create national (read: French) tech champions that can then compete globally. Berlin would prefer to work with allies on tech issues, though the newly-installed government is starting to change its tune.

Thanks for reading the free monthly version of Digital Politics. Paid subscribers receive at least one newsletter a week. If that sounds like your jam, please sign up here.

Here's what paid subscribers read in October:
— How social media failed to respond to the highest level of global conflict since WWII; The fight over semiconductors between China and the US is worsening the "splinternet;" DeepSeek's vaunted success may not what it first appears. More here.
— The European Union's AI strategy is re-living mistakes of previous shifts in global technology; Domestic US politics overshadow the global attacks on online safety laws; The consequences of Big Tech's pullback on political ad transparency is a hit to free speech. More here.
— Social media is no longer 'social.' That requires a rethink about how these platforms are overseen; How US tech companies are balancing domestic and international pledges on 'digital sovereignty;' Most governments don't have a plan to combat disinformation. More here.
— Get ready for the rise of a 'digital age of minority;' AI-powered deepfakes are getting harder detect — even if they have yet to affect democratic elections; The global "AI Stack" is quickly consolidating around select few firms. More here.
— The case for why everyone should double down on social media oversight despite the growing hype around artificial intelligence. More here.

Yet at its core, both countries are seeking to take a more hands-on approach to digital policymaking that focuses on digital public infrastructure, incentives tied to public tenders for technology contracts and greater government support for domestic companies to compete on the global stage. That could include nudging ministries to use local alternatives to American cloud providers like AWS or Google. It may involve government support for startups to hire the best talent and access new European (and global) markets. It could see officials actively embedding themselves in industrial policy decisions so that more high-end technology is built in Europe — as part of growing public support to wean the bloc off a perceived reliance on US Big Tech giants.

There's still uncertainty about what the communiqué that will arise from the Nov 18 event will say. US officials have been doing the rounds in EU capitals (and not just in Berlin and Paris) to warn national officials of promoting an "anti-American" slant to whatever Europe decides to do with its digital sovereignty ambitions. But, at its core, the summit will be dedicated to placing the government and policymakers at the center of digital policymaking changes to jumpstart the bloc's economy.

Contrast that to what the European Commission is slated to announce a day later on Nov 19 (though that date has yet to be officially confirmed.) As part of the Digital Omnibus, expect a slate of announcements to pare back Europe's digital rulebook in the name of economic growth.

There are rumors that parts of the AI Act will be shelved. I don't think that will happen. Instead, my bet is on a more protracted roll-out of the world's only comprehensive legislation for the emerging technology aimed at giving European firms more time to figure out their AI strategies. I would argue that few of these firms will be affected by the most stringent parts of the AI Act. But Henna Virkkunen, the European Commission's vice-president for technology sovereignty, security and democracy, has made it clear her priority when it comes to AI is about generating growth, not cumbersome regulation.

In other parts of the upcoming Digital Omnibus we'll also likely see other retrenchment from Europe's flaunted world-class digital regulation. This will be framed as unleashing the bloc's economic potential by making it easier for small- and medium-sized enterprises to sell their wares globally without falling afoul of the perceived excesses of digital regulation. Europe's privacy rules, in particular, will likely come under scrutiny because of the misunderstanding that such rules have made it harder for small firms to compete. When it comes to European bigger firms, that is certainly true. But I have seen little evidence to suggest that tough data protection rules, when implemented correctly, lead to burdensome oversight for smaller companies, almost all of which do not have to comply with the most stringent of oversight.

EU policymakers argue the dual events this month go hand-in-hand. That you can have a more top-down industrial policy directed by national leaders and an effort to reduce the digital regulatory burden to unleash the Continent's economic potential.

I don't buy that.

First, Europe needs to define what it wants out of its digital sovereignty agenda that remains divided between EU member countries' diverging interests and an inability to craft a coherent policymaking agenda when global competitors like the US and China are quickly moving ahead. Yes, the bloc is not a country, and such decisions are inherently slow. But Brussels has had more than five years to conjure up a digital sovereignty ethos, and it has failed to do so.

Second, the perception driven home by Draghi's competitiveness report that all digital regulation is harmful to the economy fundamentally misunderstands how Europe's digital economy works. It's not GDPR or the soon-to-be slow-rolled AI Act that is holding back Portugal or Sweden. It's the endemic failure of generations of EU policymakers to create a functioning digital single market that can allow European companies to leverage Continent-wide talent and financial resources.

Reining back digital rules may play into the politics of late 2025 when national leaders all want to <<checks talking points>> unleash the potential of AI onto society. But the Digital Omnibus will fail to grapple with the EU's underlying structural challenges that remain the main driver for why the bloc is third in the three-person race with China and the US on technology.

Until national leaders and policymakers clearly link their digital sovereignty ambitions with a well-thought-out strategy toward digital rulemaking, Europe's also-ran status is unlikely to change.

The two events later this month represent a missed opportunity to bring the dueling strategies — one pushing for greater government intervention, the other calling for less regulatory oversight — into one coherent message. That could have included finally articulating what a forward-looking digital sovereignty agenda would look like that focused on competitiveness, social cohesion and the promotion of Europe's fundamental values, at home and abroad.

Instead, the Nov 18 summit and the Nov 19 announcement will likely stand in contrast to one another as a sign that, again, the EU has failed to meet the opportunity presented by the US (the world's largest democratic power) pulling back from the global stage.

Chart of the week

LOBBYING IN BRUSSELS HAS NEVER BEEN at the same scale as what happens in Washington. In part, that's because the EU is not as transparent in forcing companies to disclose what they spend annually to nudge lawmakers in one way or another.

Still, tech companies have increased their collective lobbying spend by roughly one-third, to $174 million, in the latest 12 month period compared to 2023, according to figures collected by Corporate Europe Observatory and LobbyControl, two advocacy groups.

Below is the breakdown of the top spenders within the digital industry. It's not surprising that many on the list continue to face significant regulatory headwinds despite Brussels calming down on its appetite for more tech rules.
Source: Corporate Europe Observatory; LobbyControlSource; EU Transparency Register

TECH INDUSTRY AND CLIMATE CHANGE

THE UNITED NATIONS ANNUAL CLIMATE CHANGE CONFERENCE will take place in Belén, Brazil from Nov 10-Nov 21. The outlook does not look good. As a lapsed climate change reporter, it's hard not to look at the current data and weep. The ten warmest years on record have all occurred between 2015-2024, according to data from the US NOAA National Centers for Environmental Information. Last year was the warmest year since global records began in 1850.

Yikes.

The tech industry, especially those firms powering the datacenter boom, must take responsibility for some of the current climate crisis.

Electricity consumption associated with datacenters, for instance, is expected to more than double by 2030, based on estimates from the International Energy Agency. By the end of the decade, that means these facilities, whose expansion is directly related to the AI boom currently engulfing the world, will need as much electricity, as a sector, as what Japan currently consumes in 2025. That's the same amount of electricity as the world's fourth largest economy.

Again, yikes.

Some of this datacenter boom will be powered by renewable energy like geothermal power. But in countries from Ireland to Chile, local residents are protesting the building of these facilities because of fears — and realities — that the new construction will either lead to rolling electricity blackouts or hikes in energy bills that will disproportionately harm lower income families.

The climate change risks are not just limited to electricity generation.

On everything from lithium battery production for electric vehicles to the waste produced by consumer electronic devices, the tech industry's effect on the wider environment can not be overstated. Yes, there are larger emitters, especially those associated with heavy industry and transport. But for a sector known for generating record profits (and now representing roughly a third of the overall market capitalization of the S&P 500 Index), the tech industry has significant cash stockpiles to address its climate change impact.

Sign up for Digital Politics

Thanks for getting this far. Enjoyed what you've read? Why not receive weekly updates on how the worlds of technology and politics are colliding like never before. The first two weeks of any paid subscription are free.

Subscribe
Email sent! Check your inbox to complete your signup.

No spam. Unsubscribe anytime.

Some firms have started to do so. Many of the world's largest tech companies have best-in-class carbon offsetting programs and have invested billions in the reduction of so-called e-waste created by their consumer products. Still, it's not enough.

As national leaders and policymakers gather in Brazil for what is likely to be a damp squib of a climate conference, it's a reminder of the growing disconnect between the tech industry's climate change footprint and its ability to play a major role in averting the most harmful environmental impact — especially when 2024 was the first calendar year when the average global temperature exceeded 1.5°C above its pre-industrial levels.

Expect many of the companies to send representatives to Belén. It's a potentially good news story for some already investing in greener versions of tech infrastructure. But with total investment in data centers, alone, expected to hit almost $600 billion this year, it's hard to reconcile the growing carbon footprint of just one part of the tech industry and the stated green ambitions of the firms behind the current tech boom.

What I'm reading:

— Ahead of the upcoming social media ban for minors in Australia, the government conducted a feasibility study into whether it could implement so-called "age assurance" across the country. The results are here.

— The US Senate held another hearing into unproven claims that Big Tech companies worked with the federal government to censor mostly right-wing voices. Here's the transcript.

— The European Commission published its work plan for 2026, including major tech regulatory pushes like the Digital Fairness Act. More here.

— More than 70 countries signed the United Nations Cybercrime Convention on Oct 25 that had been criticized for failing to uphold basic fundamental rights. You can read the treaty here.

— Academics from Oxford University outlined a potential pathway forward in how the ways countries oversee artificial intelligence can be brought together. More here.

digitalpolitics.co/newsletter0…

CardFlix: NFC Cards for Kid-Friendly Streaming Magic

For most of us, the days of having to insert a disc to play our media are increasingly behind us. But if you’d like to provide your kids with the experience, you could use CardFlix.

For the electronics, [Udi] used the readily available ESP8266 D1 Mini module connected via I2C to a PN532 NFC reader. To trigger the different movies, there are over 50 cards, each with not only its unique NFC tag but also small posters that [Udi] printed showing the show and then laminated, ensuring they will survive plenty of use. The D1 Mini and NFC reader are housed in a 3D printed case, which ends up being almost smaller than the 5V DC adapter powering it, allowing it to be mounted above an outlet out of the way. The deck of movie cards is also housed in a pair of printed boxes: the larger one for the whole collection and a small one for the most often used shows. Should you want to print your own, all the design files are provided in the write-up.

The D1 Mini was programmed using ESPHome. This firmware allows it to easily connect back to Home Assistant, which does most of the heavy lifting for this project. When a card is scanned, Home Assistant can tell which TV the scanner was near, allowing this system to be used in more than one location. It also knows which card was scanned so it can play the right movie. Home Assistant also handles ensuring the TV in question is powered on, as well as figuring out what service should be called for that particular movie to be shown.

Be sure to check out some of the other projects we’ve featured that use ESPHome to automate tasks.

youtube.com/embed/_sqxoAX3GW0?…

hackaday.com/2025/11/05/cardfl…

Pericolo per gli utenti OneDrive: le DLL infette si nascondono nei file condivisi

Gli aggressori stanno utilizzando una tecnica avanzata che implica il caricamento laterale di DLL tramite l’applicazione Microsoft OneDrive. In questo modo riescono ad eseguire codice malevolo senza essere rilevati dai meccanismi di sicurezza.

L’attacco informatico utilizza una libreria dll modificata come strumento per deviare i processi legittimi di Windows e assicurare la persistenza sui sistemi infetti. Questo metodo si dimostra particolarmente efficace perché evita le modifiche persistenti al codice che i sistemi di rilevamento basati sulle firme solitamente identificano.

Secondo l’avviso di sicurezza di Kas-sec, gli aggressori hanno inserito un file version.dll contraffatto nella stessa directory di OneDrive.exe, sfruttando l’ordine di ricerca delle dipendenze dell’applicazione.

La tecnica prende di mira specificamente version.dll perché molte applicazioni Windows, tra cui OneDrive, si basano su questa libreria per recuperare informazioni sulla versione dei file. Quando OneDrive.exe viene avviato, carica la DLL dannosa dalla sua directory locale prima di cercare nelle directory di sistema.

Gli aggressori, posizionando in modo strategico la DLL malevola, sono in grado di eseguire codice all’interno del contesto fidato di un’applicazione Microsoft dotata di firma digitale, superando di fatto i controlli di sicurezza volti a monitorare i processi anomali. Al fine di salvaguardare la clandestinità e scongiurare interruzioni anomale delle applicazioni, gli aggressori utilizzano metodologie di proxy delle DLL.

La versione dannosa della dll esporta le stesse funzioni della libreria legittima, inoltrando chiamate di funzioni legittime alla versione System32 originale di Windows mentre esegue operazioni in background.

Questa doppia funzionalità garantisce che OneDrive.exe continui a funzionare normalmente, riducendo la probabilità di essere rilevato da utenti o software di sicurezza. L’attacco impiega una tecnica di hooking avanzata che sfrutta la gestione delle eccezioni e il flag di protezione della memoria PAGE_GUARD.

Invece dei tradizionali metodi di hooking inline facilmente rilevabili dagli strumenti di sicurezza, questo approccio attiva intenzionalmente eccezioni di memoria per intercettare le chiamate API. Quando OneDrive.exe tenta di chiamare funzioni specifiche come CreateWindowExW, il codice dannoso cattura il flusso di esecuzione tramite gestori di eccezioni e lo reindirizza alle funzioni controllate dall’aggressore.

L’hook si riarma dopo ogni intercettazione utilizzando eccezioni in un unico passaggio, mantenendo un controllo continuo sulle funzioni API mirate.

L'articolo Pericolo per gli utenti OneDrive: le DLL infette si nascondono nei file condivisi proviene da Red Hot Cyber.