At a time when so-called “artificial intelligence” seems inescapable, we were encouraged to see news that Amazon will be cracking down on third-party sellers that use AI-generated images for their product listings. They won’t be prevented from using the images, but they will need to clearly indicate that they don’t represent reality and were produced via artificial means. This comes in response to a recently enacted New York law that requires the disclosure of AI in advertisements.

Will this be the end of the cat sleeping bag?

But it’s not quite a clear cut as it might seem on the surface, as the New York law is actually about AI-generated people rather than products. Specifically, it’s designed to make it clear when a “synthetic performer” has been used in place of a human actor. As such, it would appear that the easiest way for Amazon sellers to dodge the new rule is to simply not include any humans in their AI slop images and videos. In other words, they can continue to post fake pictures of products without having to inform the consumer so long as they don’t show a fake person holding it.

Under normal circumstances we’d leave something like this next one for our weekly security column, but the utter lack of security in the Pope’s official “Click To Pray” mobile application revealed by researcher BobDaHacker on Friday is just too good a story to pass up. For one thing, who knew that there was an “official” prayer app? We don’t dabble in theology around these parts, but we’re fairly sure the good book didn’t mention anything about requiring a smartphone to give praise.

In any event, the service was so poorly constructed that you could simply step through the sequentially assigned numerical user IDs via the endpoint at api.clicktopray.org — because of course there’s a prayer API — and download any user’s personal information such as their full name, email address, and date of birth. There wasn’t even any rate limiting, so BobDaHacker was able to write simple script to quickly suck up the account details for each one of the service’s 700,000+ faithful users.

After waiting six months for a response from anyone at the Pope’s Worldwide Prayer Network, BobDaHacker took the story to the press. That seemed to get the pontiff’s attention, as the issue has now been addressed. Amen.

We know many readers appreciate a more minimalist approach to software, and still others are operating older devices that struggle with the admittedly ponderous bulk of the modern web. Both groups will likely appreciate brolly.sh, which provides a plain-text weather forecast for anywhere on Earth using data from Open-Meteo. It doesn’t just look the part either — we’re happy to report that if you pull down the forecast page for your location using something like wget, the resulting file is plain HTML which could be further parsed with grep and friends if you’re on a machine that doesn’t have a browser.

Speaking of older devices,

Hack a day

Message History

Delivery option(s)