"In the battle for Ukraine, the front line is increasingly at a standstill" because of "rapid innovations in drone technology..." according to the Wall Street Journal. "Each side has hundreds of them constantly in the air across the 750-mile front line."

And drones "now bring everything from food and water to ammunition, power banks — and, in at least one case, a fire extinguisher — to the front, sparing soldiers trips through the most dangerous part of the battlefield where enemy drones might pick them off." Drones can lay mines, deliver everything from ammunition to medication and even evacuate wounded or dead soldiers. Crucially, drones spot any movement along the front line and are dispatched to strike enemy troops and vehicles. When Russia sent tank columns into Ukraine in February 2022, Ukraine needed to find out where they were headed — and fast. Enter the humble "wedding drone," available in stores for about $2,000 and repurposed to scan for enemy units rather than capture nuptial panoramas. Deployed by enthusiasts acting independently or attached to army units, the drones helped Ukrainian forces, which were vastly outnumbered and outgunned, to know exactly where to deploy to counter Russian arrowheads.

Surveillance drones quickly became a necessity rather than a luxury. Often provided by charity funds, they were used to scan enemy positions for equipment, stores and headquarters.... A cheap and simple tweak made the so-called wedding drones deadly. Tech buffs realized that a simple claw-like contraption, created using a 3-D printer, could be activated from the radio controller by turning on the drone's light, causing it to release a grenade. The explosion could wound or kill a soldier or even detonate an armored vehicle if dropped through its hatch. Over time, soldiers experimented with ways to add more explosives, for example by melting down explosives garnered from Soviet-era munitions and pouring them into new, lighter plastic casings.

No innovation has had a bigger impact on the war in Ukraine than first-person-view, or FPV, drones. With explosives strapped to them, FPVs fly directly into their targets, turning them into low-cost suicide bombers. Though FPVs don't deliver as much explosive punch as rockets, they are far more accurate — and the sheer volume that Ukraine has manufactured means they can be deployed to similar effect... Sitting in a bunker several miles behind the front, a drone pilot slips on FPV goggles to see the view from the drone's camera and fly it into an enemy position or asset. The Russians have since adopted FPVs en masse. Their abundance has played a central role in slowing down the movement of the front line. Anything within around 12 miles of the contact line can now become a target for FPVs. They are so cheap to make that both sides can expend them on any target — even a single infantryman.

Because they are so small and fast, FPVs are difficult to shoot down. The main defense against them has been electronic jamming systems, which disrupt the communication between the drone and the pilot. Though most drone innovations in the war have come from the Ukrainian side, the Russians pioneered the most important adaptation for FPV drones — the addition of a fiber-optic cable connecting the drone to the pilot that can overcome jamming.
Benjamin Franklin once predicted flying machines might "convince sovereigns of the folly of war... since it will be impracticable for the most potent of them to guard his dominions..."

Electrek reports on the new Omo X, a scooter planned for release in 2026 that's "full of premium tech features that blur the lines between e-scooter and self-driving EV." At its recent launch in Jakarta, the Omo X didn't just sit pretty center stage, it actually drove itself onto the stage using its "Halo Pilot" system, which apparently comes complete with adaptive cruise control, remote summon, self-parking, and even automatic reversing and self-balancing at low speeds. This is legit autonomous behavior previously reserved for cars, now shrunk down and smoothed out for a two-wheeler. Under the hood — or rather, behind the sleek bodywork — Omoway's Halo architecture delivers collision warning, emergency-brake assist, blind spot monitoring, and V2V [vehicle-to-vehicle] communication.

The frame is modular, too. It can be reconfigured in step-through, straddle, or touring posture to suit casual riders, commuters, and motorcycle wannabes alike. That kind of flexibility isn't just a marketing gimmick, but rather it looks purpose-built to capture diverse motorcycle-heavy markets like Indonesia, which counts over 120 million two-wheelers and is quickly transitioning to electric models... It's tech-rich, head-turning, and seems built to evolve with software updates. The remote summon and AI-assisted features could genuinely simplify urban mobility, and tricks like automatically driving itself to a charging station sound legitimately useful...

[But] Omoway's vision here will have to carry extra sensors, actuators, and redundant systems to support those smart functions. With added costs and complexity, will riders in developing markets pay a premium, carry extra maintenance risk, or worry about obsolescence? Much hinges on Omoway's software support and local service networks.
The article reports a projected price around €3,500 (roughly $3,800). "And while Indonesia may have been the launchpad, global markets aren't off the table..."

An anonymous reader shared this report from Jalopnik: On July 2, the 88th anniversary of famed aviator Amelia Earhart's disappearance, Purdue University announced an expedition [which will launch in November] to confirm whether or not the wreckage of her plane has been found.

Satellite imagery from a decade ago indicated the presence of something that sure looks plane-like under the waters of Nikumaroro Island, an uninhabited spit of land in the middle of the Pacific Ocean that just happens to be near Earhart's intended flightpath...

This isn't the first time Earhart investigators have been to Nikumaroro. Human bones were recovered from the island previously, which scientists determined with 99% confidence to belong to the beloved pilot, per the university's student newspaper the Purdue Exponent. The investigators also found some women's beauty products from the 1930s. If that is indeed where Earhart died, it stands to reason that her Lockheed Electra 10E, nicknamed the Flying Laboratory, wouldn't be far away. Since nobody noticed any aircraft wreckage on the island (which isn't very big), it would probably be under the water.

Recovering such a legendary airplane will be a multi-stage process spanning years. This expedition, which will embark in November, is only planning to verify what's actually there, not retrieve anything. Recent satellite imagery doesn't show the object anymore, meaning it might have become buried; in fact, it was only ever visible in 2015, right after a cyclone blew threw and shifted a bunch of sand, as NBC News reports. The team will start with non-invasive procedures, such as sonar and magnetometers, before drilling through the silt with a hydroglobe to make physical contact with the object. Lastly, they will use a suction dredge to pull off loose sediment. If they're lucky, that will be sufficient to actually see part of the Lockheed Electra.

Lucid Motors set a Guinness World Record for the longest journey by an electric car on a single charge, covering a distance of 749 miles (about 1,205 km), reports New Atlas. "In doing so, Lucid broke the 1,045-km (649-mile) record previously achieved by the Mercedes-Benz EQS450+ in June 2025 by the Japanese car website www.webcg.net/articles/-/52268webCG." The electric vehicle covered this journey between St. Moritz, Switzerland, and Munich, Germany, traveling through highways, secondary roads, and alpine roads — all without a single halt for charging. Given that the vehicle has a 960-km (596-mile) WLTP range, my guess is that the test team must have made good use of favorable road and weather conditions to make the feat possible. With a net elevation decrease of just over 1,310 m (about 4,300 ft) throughout the drive, the EV most certainly benefited from regenerative braking, a rather useful feature that turns downhill momentum back into battery power. Lucid has yet to release official data like average speed or total drive time, but what is apparent is that this was not a high-speed dash but rather a well-planned route to achieve one impressive result...

The Air Grand Touring has two all-wheel drive electric motors with a combined system output of 611 kW (819 horsepower) and 1,200 Nm (885 lb.ft) of torque. Power is provided by an NMC battery, which has a gross energy capacity of 117 kWh (112 kWh usable). Best of all, it can go from 0-60 mph in just three seconds flat... For reference, the almost half-priced BMW i4 and jazzy Porsche Taycan offer less than half the WLTP range of the Lucid Air GT. So, it's not like there's a head-to-head competition out there. Lucid is miles ahead in its class (pun intended!)

Starting at US$112,650, the Air Grand Touring is among the most luxurious sedans on the market right now. But as you can see, it comes at a price. Still, knowing that there is technology to conquer range anxiety is comforting. It might take a while, but there's no reason why we can't expect such range figures from reasonably priced EVs in the near future.

"Firefox is dead to me," wrote Steven J. Vaughan-Nichols last month for The Register, complaining about everything from layoffs at Mozilla to Firefox's discontinuation of Pocket and Fakespot, its small market share, and some user complaints that the browser might be becoming slower. But a new rebuttal (also published by The Register) argues instead that Mozilla just has "a management layer that doesn't appear to understand what works for its product nor which parts of it matter most to users..."

"Steven's core point is correct. Firefox is in a bit of a mess — but, seriously, not such a bad mess. You're still better off with it — or one of its forks, because this is FOSS — than pretty much any of the alternatives." Like many things, unfortunately, much of computing is run on feelings, tradition, and group loyalties, when it should use facts, evidence, and hard numbers. Don't bother saying Firefox is getting slower. It's not. It's faster than it has been in years. Phoronix, the go-to site for benchmarks on FOSS stuff, just benchmarked 21 versions, and from late 2023 to now, Firefox has steadily got faster and faster...

Ever since Firefox 1.0 in 2004, Firefox has never had to compete. It's been attached like a mosquito to an artery to the Google cash firehose... Mozilla's leadership is directionless and flailing because it's never had to do, or be, anything else. It's never needed to know how to make a profit, because it never had to make a profit. It's no wonder it has no real direction or vision or clue: it never needed them. It's role-playing being a business. Like we said, don't blame the app. You're still better off with Firefox or a fork such as Waterfox. Chrome even snoops on you when in incognito mode...

One observer has been spectating and commentating on Mozilla since before it was a foundation — one of its original co-developers, Jamie Zawinksi... Zawinski has repeatedly said: "Now hear me out, but What If...? browser development was in the hands of some kind of nonprofit organization?"

"In my humble but correct opinion, Mozilla should be doing two things and two things only:

— Building THE reference implementation web browser, and
— Being a jugular-snapping attack dog on standards committees.
— There is no 3."


Perhaps this is the only viable resolution. Mozilla, for all its many failings, has invented a lot of amazing tech, from Rust to Servo to the leading budget phone OS. It shouldn't be trying to capitalize on this stuff. Maybe encourage it to have semi-independent spinoffs, such as Thunderbird, and as KaiOS ought to be, and as Rust could have been. But Zawinski has the only clear vision and solution we've seen yet. Perhaps he's right, and Mozilla should be a nonprofit, working to fund the one independent, non-vendor-driven, standards-compliant browser engine.

Slashdot reader BrianFagioli shared this report from Nerds.xyz: NVIDIA just put out a new security notice, and if you're running one of its powerful GPUs, you might want to pay attention. Researchers from the University of Toronto have shown that Rowhammer attacks, which are already known to affect regular DRAM, can now target GDDR6 memory on NVIDIA's high-end GPUs when ECC [error correction code] is not enabled.

They pulled this off using an A6000 card, and it worked because system-level ECC was turned off. Once it was switched on, the attack no longer worked. That tells you everything you need to know. ECC matters.

Rowhammer has been around for years. It's one of those weird memory bugs where repeatedly accessing one row in RAM can cause bits to flip in another row. Until now, this was mostly a CPU memory problem. But this research shows it can also be a GPU problem, and that should make data center admins and workstation users pause for a second.

NVIDIA is not sounding an alarm so much as reminding everyone that protections are already in place, but only if you're using the hardware properly. The company recommends enabling ECC if your GPU supports it. That includes cards in the Blackwell, Hopper, Ada, and Ampere lines, along with others used in DGX, HGX, and Jetson systems. It also includes popular workstation cards like the RTX A6000.

There's also built-in On-Die ECC in certain newer memory types like GDDR7 and HBM3. If you're lucky enough to be using a card that has it, you're automatically protected to some extent, because OD-ECC can't be turned off. It's always working in the background. But let's be real. A lot of people skip ECC because it can impact performance or because they're running a setup that doesn't make it obvious whether ECC is on or off. If you're not sure where you stand, it's time to check. NVIDIA suggests using tools like nvidia-smi or, if you're in a managed enterprise setup, working with your system's BMC or Redfish APIs to verify settings.

The advocacy group Free Press on Friday blasted America's Federal Communications Commission chief "for an order that rips net neutrality rules off the books, without any time for public comment, following an unfavorable court ruling," reports the nonprofit progressive news site Common Dreams: A panel from the U.S. Court of Appeals for the 6th Circuit ruled in January that broadband is an "information service" instead of a "telecommunications service" under federal law, and the FCC did not have the authority to prohibit internet service providers (ISPs) from creating online "fast lanes" and blocking or throttling web content... FCC Chair Brendan Carr said in a Friday statement that as part of his "Delete, Delete, Delete" initiative, "we're continuing to clean house at the FCC, working to identify and eliminate rules that no longer serve a purpose, have been on our books for decades, and have no place in the current Code of Federal Regulations...."

Responding in a lengthy statement, Free Press vice president of policy and general counsel Matt Wood said that "the FCC's so-called deletion today is little more than political grandstanding. It's true that the rules in question were first stayed by the 6th Circuit and then struck down by that appellate court — in a poorly reasoned opinion. So today's bookkeeping maneuver changes very little in reality... There's no need to delete currently inoperative rules, much less to announce it in a summer Friday order. The only reason to do that is to score points with broadband monopolies and their lobbyists, who've fought against essential and popular safeguards for the past two decades straight...."

Wood noted that "the appeals process for this case has not even concluded yet, as Free Press and allies sought and got more time to consider our options at the Supreme Court. Today's FCC order doesn't impact either our ability to press the case there or our strategic considerations about whether to do so," he added. "It's little more than a premature housekeeping step..."

Slashdot reader hcs_$reboot shared this report from NPR: A pair of switches that control the fuel supply to the engines were set to "cutoff" moments before the crash of Air India Flight 171, according to a preliminary report from India's Air Accident Investigation Bureau released early Saturday in India... Indian investigators determined the jet was properly configured and lifted off normally. But three seconds after takeoff, the engines' fuel switches were cut off. It's not clear why.

According to the report, data from the flight recorders show that the two fuel control switches were switched from the "run" position to "cutoff" shortly after takeoff. In the cockpit voice recording, one of the pilots can be heard asking the other "why did he cutoff," the report says, while "the other pilot responded that he did not do so." Moments later, the report says, the fuel switches were returned to the "run" position. But by then, the plane had begun to lose thrust and altitude. Both the engines appeared to relight, according to investigators, but only one of them was able to begin generating thrust.

The report does not draw any further conclusions about why the switches were flipped, but it does suggest that investigators are focused on the actions of the plane's pilots. The report does not present any evidence of mechanical failures or of a possible bird strike, which could have incapacitated both engines at the same time.

An anonymous reader quotes a report from Reuters: Contrary to popular belief, using cutting-edge artificial intelligence tools slowed down experienced software developers when they were working in codebases familiar to them, rather than supercharging their work, a new study found. AI research nonprofit METR conducted the in-depth study on a group of seasoned developers earlier this year while they used Cursor, a popular AI coding assistant, to help them complete tasks in open-source projects they were familiar with. Before the study, the open-source developers believed using AI would speed them up, estimating it would decrease task completion time by 24%. Even after completing the tasks with AI, the developers believed that they had decreased task times by 20%. But the study found that using AI did the opposite: it increased task completion time by 19%. The study's lead authors, Joel Becker and Nate Rush, said they were shocked by the results: prior to the study, Rush had written down that he expected "a 2x speed up, somewhat obviously." [...]

The slowdown stemmed from developers needing to spend time going over and correcting what the AI models suggested. "When we watched the videos, we found that the AIs made some suggestions about their work, and the suggestions were often directionally correct, but not exactly what's needed," Becker said. The authors cautioned that they do not expect the slowdown to apply in other scenarios, such as for junior engineers or engineers working in codebases they aren't familiar with. Still, the majority of the study's participants, as well as the study's authors, continue to use Cursor today. The authors believe it is because AI makes the development experience easier, and in turn, more pleasant, akin to editing an essay instead of staring at a blank page. "Developers have goals other than completing the task as soon as possible," Becker said. "So they're going with this less effortful route."

OpenAI's planned acquisition of Windsurf has fallen apart. Instead, Google is hiring Windsurf CEO Varun Mohan, cofounder Douglas Chen, and parts of its R&D team to join DeepMind and focus on agentic coding for Gemini. Google will not acquire Windsurf but will receive a non-exclusive license to some of its technology, while Windsurf continues independently under new leadership. The Verge reports: Effective immediately, Jeff Wang, Windsurf's head of business, has become interim CEO, and Graham Moreno, its VP of global sales, will be Windsurf's new president. "Gemini is one of the best models available and we've been investing in its advanced capabilities for developers," Chris Pappas, a spokesperson for Google, told The Verge in a statement. "We're excited to welcome some top AI coding talent from Windsurf's team to Google DeepMind to advance our work in agentic coding."

"We are excited to be joining Google DeepMind along with some of the Windsurf team," Mohan and Chen said in a statement. "We are proud of what Windsurf has built over the last four years and are excited to see it move forward with their world class team and kick-start the next phase." Google didn't share how much it was paying to bring on the team. OpenAI was previously reported to be buying Windsurf for $3 billion.

BYD has unveiled fully autonomous Level 4 self-parking across its vehicle lineup, powered by its advanced multi-sensor "God's Eye" system that's used by more than 1 million cars across China. "The company is so confident in the technology that it announced that it will cover any damages to your car or any other vehicle if things go wrong," adds Fast Company. "This means if anything happens, the owner won't have to file a claim and have their premiums go up." From the report: BYD's confidence stems from a sophisticated sensor architecture. The God's Eye system deploys multiple sensing technologies working in concert, unlike Tesla's problematic camera-only approach. Even the entry-level God's Eye C variant -- one of three autonomous driving levels included in most affordable models -- includes 12 cameras, 5 millimeter-wave radars, and 12 ultrasonic sensors with 1-centimeter accuracy. The mid-tier God's Eye B adds a lidar sensor, while the premium God's Eye A variant features three lidar sensors for maximum precision.

The system's parking accuracy allows the car to get within 0.8 inches of other objects, enabled by multiple redundant sensors that create a three-dimensional map. This allows the vehicle a deep understanding of its environment. This multi-sensor approach allows the system to detect obstacles. It can even recognize hanging objects over the roof line of the car.

The company reports that more than 1 million vehicles now carry the God's Eye system, an impressive deployment scale that starts with the most inexpensive models, like the $9,550 BYD Seagull, and go all the way to the $236,000 BYD Yangwang U9, a hypercar that can detect potholes on the road and jump over them. Yes. If the God's Eye detects an obstacle on the road, it will literally jump over it.

An anonymous reader quotes a report from Ars Technica: For the second time in a year, Google has announced that it will render some of its past phones almost unusable with a software update, and users don't have any choice in the matter. After nerfing the Pixel 4a's battery capacity earlier this year, Google has now confirmed a similar update is rolling out to the Pixel 6a. The new July Android update adds "battery management features" that will make the phone unusable. Given the risks involved, Google had no choice but to act, but it could choose to take better care of its customers and use better components in the first place. Unfortunately, a lot more phones are about to end up in the trash. [...]

Pixel 4a units contained one of two different batteries, and only the one manufactured by a company called Lishen was downgraded. For the Pixel 6a, Google has decreed that the battery limits will be imposed when the cells hit 400 charge cycles. Beyond that, the risk of fire becomes too great -- there have been reports of Pixel 6a phones bursting into flames. Clearly, Google had to do something, but the remedies it settled on feel unnecessarily hostile to customers. It had a chance to do better the second time, but the solution for the Pixel 6a is more of the same. [...]

When Google killed the Pixel 4a's battery life, it offered a few options. You could have the battery replaced for free, get $50 cash, or accept a $100 credit in the Google Store. However, claiming the money or free battery was a frustrating experience that was rife with fees and caveats. The store credit is also only good on phones and can't be used with other promotions or discounts. And the battery swap? You'd better hope there's nothing else wrong with the device. If it has any damage, like cracked glass, it may not qualify for a free battery replacement.

Now we have the Pixel 6a Battery Performance Program with all the same problems. Pixel 6a owners can get $100 in cash or $150 in store credit. Alternatively, Google offers a free battery replacement with the same limits on phone condition. This is all particularly galling because the Pixel 6a is still an officially supported phone, with its final guaranteed update coming in 2027. Google also pulled previous software packages for this phone to prevent rollbacks. [...] If you have a Pixel 6a, the battery-killing update is rolling out now. You'll have no choice but to install it if you want to remain on the official software. Google has a support site where you can try to get a free battery swap or some cash.

New submitter RJFerret shares a Belkin support page: After careful consideration, we have made the difficult decision to end technical support for older Wemo products, effective January 31, 2026. After this date, several Wemo products will no longer be controllable through the Wemo app. Any features that rely on cloud connectivity, including remote access and voice assistant integrations, will no longer work.'

List of devices found in the link (four Thread based unaffected).

The city of Centerville, Ohio has deployed AI-enabled garbage trucks that scan residents' trash and send personalized postcards scolding them for improper recycling. Dayton Daily News reports: "Reducing contamination in our recycling system lowers processing costs and improves the overall efficiency of our collection," City Manager Wayne Davis said in a statement regarding the AI pilot program. "This technology allows us to target problem areas, educate residents and make better use of city resources." Residents whose items don't meet the guidelines will be notified via a personalized postcard, one that tells them which items are not accepted and provides tips on proper recycling.

The total contract amount for the project is $74,945, which is entirely funded through a Montgomery County Solid Waste District grant, Centerville spokeswoman Kate Bostdorff told this news outlet. The project launched Monday, Bostdorff said. "A couple of the trucks have been collecting baseline recycling data, and we have been working through software training for a few weeks now," she said. [...] Centerville said it will continually evaluate how well the AI system works and use what it learns during the pilot project to "guide future program enhancements."

BrianFagioli shares a report from NERDS.xyz: Android is changing how it gives developers access to early features. The company is replacing its old Developer Preview model with a new Canary channel that provides rolling updates all year long. This new approach is meant to give developers earlier and more consistent access to experimental tools and APIs.

Previously, Developer Previews had to be manually flashed onto devices. They only ran during the earliest stages of each release cycle and stopped once Android entered the beta phase. That meant promising features that were not quite ready for beta had nowhere to go and no way to collect feedback. The Canary channel solves that by running in parallel with the existing beta program and delivering over the air updates automatically.

An anonymous reader quotes a report from The Record: A German court has ruled that Meta must pay $5,900 to a German Facebook user who sued the platform for embedding tracking technology in third-party websites -- a ruling that could open the door to large fines down the road over data privacy violations relating to pixels and similar tools. The Regional Court of Leipzig in Germany ruled Friday that Meta tracking pixels and software development kits embedded in countless websites and apps collect users' data without their consent and violate the continent's General Data Protection Regulation (GDPR).

The ruling in favor of the plaintiff sets a precedent which the court acknowledged will allow countless other users to sue without "explicitly demonstrating individual damages," according to a Leipzig Regional Court press release. "Every user is individually identifiable to Meta at all times as soon as they visit the third-party websites or use an app, even if they have not logged in via the Instagram and Facebook account," the press release said. "This may very well be one of the most substantial rulings coming out of Europe this year," said Ronni K. Gothard Christiansen, the CEO of AesirX, a consultancy which helps businesses comply with data privacy laws. "$5,900 in damages for one visitor adds up quickly if you have tens of thousands of visitors, or even millions."

Google is rolling out photo-to-video generation in its Gemini app today, allowing paid subscribers to upload images and transform them into short AI videos using the company's Veo 3 model. The feature requires a subscription to Google's AI Pro plan at $20 per month for three daily video generations, or the $250 AI Ultra plan for five daily videos.

Videos are limited to 720p resolution and eight seconds in length, taking several minutes to generate due to computational requirements.

Mazda is redesigning the steering wheel controls in its new CX-5 to address potential safety concerns from its shift to touchscreen-based infotainment systems. The Japanese automaker developed what it calls "an all new steering wheel layout with physical buttons" that allow drivers to control critical vehicle functions without taking their hands off the wheel. Stefan Meisterfeld, Mazda's U.S. VP of operations, said the new steering wheel design goes beyond simple redundant shortcuts.

The company is pairing the enhanced steering wheel controls with Google Assistant voice commands and a 15.6-inch central touchscreen that now houses audio and climate controls previously operated by physical dashboard buttons. Mazda had been the sole mainstream holdout against touchscreen infotainment systems, relying instead on a console-mounted dial. The steering wheel redesign represents the company's attempt to maintain its "hands on the wheel, eyes on the road" safety philosophy while adopting touchscreen technology that customer research indicated buyers wanted.

European Union officials unveiled new AI regulations on Thursday that require makers of the most powerful AI systems to improve transparency, limit copyright violations and protect public safety.

The rules apply to companies like OpenAI, Microsoft and Google that develop general-purpose AI systems underpinning services like ChatGPT, which can analyze enormous amounts of data and perform human tasks. The code of practice provides concrete details about enforcing the AI Act passed last year, with rules taking effect August 2.

EU regulators cannot impose penalties for noncompliance until August 2026. Companies must provide detailed breakdowns of content used for training algorithms and conduct risk assessments to prevent misuse for creating biological weapons. CCIA Europe, representing Amazon, Google and Meta, told New York Times the code imposes a disproportionate burden on AI providers.

An anonymous reader quotes a report from TechCrunch: On Sunday, Block CEO and Twitter co-founder Jack Dorsey launched an open source chat app called Bitchat, promising to deliver "secure" and "private" messaging without a centralized infrastructure. The app relies on Bluetooth and end-to-end encryption, unlike traditional messaging apps that rely on the internet. By being decentralized, Bitchat has potential for being a secure app in high-risk environments where the internet is monitored or inaccessible. According to Dorsey's white paper detailing the app's protocols and privacy mechanisms, Bitchat's system design "prioritizes" security.

But the claims that the app is secure, however, are already facing scrutiny by security researchers, given that the app and its code have not been reviewed or tested for security issues at all -- by Dorsey's own admission. Since launching, Dorsey has added a warning to Bitchat's GitHub page: "This software has not received external security review and may contain vulnerabilities and does not necessarily meet its stated security goals. Do not use it for production use, and do not rely on its security whatsoever until it has been reviewed." This warning now also appears on Bitchat's main GitHub project page but was not there at the time the app debuted.

As of Wednesday, Dorsey added: "Work in progress," next to the warning on GitHub. This latest disclaimer came after security researcher Alex Radocea found that it's possible to impersonate someone else and trick a person's contacts into thinking they are talking to the legitimate contact, as the researcher explained in a blog post. Radocea wrote that Bitchat has a "broken identity authentication/verification" system that allows an attacker to intercept someone's "identity key" and "peer id pair" -- essentially a digital handshake that is supposed to establish a trusted connection between two people using the app. Bitchat calls these "Favorite" contacts and marks them with a star icon. The goal of this feature is to allow two Bitchat users to interact, knowing that they are talking to the same person they talked to before.