Security firm Socket uncovered a campaign, active since early 2024, in which 16 malware modules were pushed through browser extensions on the Chrome Web Store and Microsoft Edge add-ons store. Five extensions were initially legitimate but were bought from their original developers and later turned malicious via automatic updates, including one tool with roughly 70,000 Chrome users and 10,000 Edge users. Once activated, the extensions connected to remote servers to strip website security headers, inject phishing scripts, and drain cryptocurrency wallets on platforms like Coinbase, Binance, Kraken and MetaMask.
OpenReel is a new web-based video editing tool that runs directly in the browser, requiring no installation or specific device or operating system. It is free to use, open source, and designed with privacy in mind since editing happens locally rather than on remote servers.
The Open Battery Information project has retired its old Python/Tkinter desktop app in favor of a new web-based interface, OBI-1, that connects directly to an Arduino or ESP32-C3 via Web Serial. The tool lets users read and reset battery management system (BMS) faults without installing any software, including flashing firmware straight from the browser.
A developer released Laser Graffiti, a Show HN project that pairs a webcam and projector so anyone can draw on a wall using a handheld laser pointer. The software tracks the laser dot and projects effects like glowing neon trails, dripping ink, or spinning 3D shapes over the strokes in real time. The creator says the project was inspired by an older video of artists laser-tagging buildings with projectors.
A developer launched Isitdoneyet.gg, a website that tracks games after their official release to note whether they remain buggy, unfinished, or still receiving critical patches. The site catalogs titles like This Bed We Made and The Children of Clay, giving players a quick reference on post-launch game health.
A group of contributors, drawing on their experience building and scaling apps on the Heroku platform, published a methodology called the Twelve-Factor App. It outlines a set of practices for building software-as-a-service applications that can use any programming language or backing services like databases and queues, aiming to reduce software erosion and ease collaboration among developers.
Transmission continues to offer a minimal, ad-free BitTorrent client with support for magnet links, DHT, PEX, encrypted connections, and a built-in web interface for remote management. It also allows users to schedule downloads and set speed limits, making it suitable for older machines, NAS devices, and always-on servers.
A developer built a web demo that replicates the broadcast 'squeezeback'—the effect where a video feed shrinks into a corner while surrounding space fills with graphics or extra content. Instead of baking this into pre-rendered video like a typical online example, the demo uses a CSS Grid with animated track sizes, placing the video player in a live, resizable cell chosen at playback time.
Schools increasingly rely on laptops and tablets for coursework, but these same devices expose students to games, social media, and web browsing that can pull focus from schoolwork. Parents often have limited ability to adjust settings on school-managed devices, making it harder to curb distractions than on family-owned technology.
Google detailed further network security changes coming with Android 17, including support for the Encrypted Client Hello protocol that encrypts DNS server lookups, a feature letting carriers automatically block low-security 2G connections used in SMS Blaster spam attacks, and restrictions preventing apps from scanning home networks for vulnerable devices. The update also builds on previously announced Certificate Transparency enforcement to ensure phones connect using legitimate SSL certificates.
OpenAI has rolled out a feature within its agentic ChatGPT Work tool that lets the AI log into password-protected websites on a user's behalf. After an initial manual login, ChatGPT stores the session's cookies and reuses them for future visits, meaning it no longer needs to ask for credentials each time. The feature is limited to ChatGPT Pro and Plus subscribers and is meant to help the AI complete multi-step tasks like renewing a passport or comparing insurance costs.
Google's next Android release will support Encrypted Client Hello, a TLS extension that encrypts the hostname portion of the connection handshake so it can no longer be read in plain text. Paired with private DNS, this stops internet providers and Wi-Fi operators from easily seeing which sites or apps a device is contacting. The feature will be on by default for apps targeting Android 17 that use updated networking libraries like OkHttp, WebView, or HttpEngine.
GoKawiil