10 interesting stories served every morning and every evening.

GitHub - bikini/exploitarium: A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. Please do not abuse these. I do this so to allure people into the field, and I've always found this is the most efficient way.

github.com

Statement

This repo was in­com­plete when pub­lished. That’s why some find­ings are kinda ass (ghidra) and some are bet­ter. Going for­ward, only se­ri­ous vul­ner­a­bil­i­ties will be shared (Floci, lib­ssh2, FFmpeg, c-ares).

In re­gard to AI us­age, my fuzzing work­flow was au­to­mated by AI with a strict har­ness. I used GPT-5.5 – 3-Codex-Spark for ALL the fuzzing, as barely any thought” is nec­es­sary when pro­vided with an ef­fi­cient har­ness. Contrary to the grow­ing nar­ra­tive that I’m just some ran­dom child burn­ing to­kens, I DO ac­tu­ally have a de­gree in the sub­ject and have pub­lished mul­ti­ple pa­pers on fuzzing method­ol­ogy. I spent years re­search­ing and de­vel­op­ing new tools and ideas for how to fuzz. You do NOT need a SOTA model to help you iden­tify these is­sues, I promise! While be­ing able to af­ford a bet­ter model is help­ful, my data seems to show that it is only mar­ginal when paired with de­cent hu­man over­sight and a good har­ness. None of the ac­tual PoCs them­selves were vibe-coded; I did, in fact, hand-type them. I did use AI as­sis­tance for RustDesk, how­ever, as I’m not as fa­mil­iar with the lan­guage. The README files are very clearly en­tirely AI, how­ever, as AI can for­mat a pretty mean Markdown file. I re­viewed them to make sure they were ac­cu­rate.

I’d also like to credit some­one for the ob­j­dump find­ing. It turns out, some­one beat me to the punch (they also have a bet­ter PoC too!). Please give them the credit they de­serve: https://​github.com/​4D4J/​ob­j­dump-Out-Of-Bounds-write

News/Contact

New drops to­day ;) Biggest thing yet

I’ve also no­ticed a sur­pris­ing amount of security re­searchers” aren’t able to ad­just the PoC to work in their en­vi­ron­ment. I will broaden the PoCs for those se­lect few…

If you wish to col­lab­o­rate/​dis­cuss with me, con­tact me on dis­cord @ashdfrkl

Sharing this repo keeps me mo­ti­vated to con­tinue drop­ping my find­ings for you all.

A con­sol­i­dated archive of my pub­lic proof-of-con­cept and vul­ner­a­bil­ity re­search write­ups.

Most fold­ers con­tain one of my for­mer stand­alone PoC re­pos, pre­served with its orig­i­nal README and tracked files. New re­search en­tries are added di­rectly here as self-con­tained fold­ers.

Contents

Consolidation Check

This sec­tion ap­plies to the for­mer stand­alone repos­i­to­ries listed above by com­mit hash.

The con­sol­i­da­tion was checked from fresh GitHub clones on June 23, 2026 be­fore the old stand­alone re­pos were re­moved.

The check com­pared each for­mer stand­alone re­po’s HEAD tree against the match­ing folder here us­ing Git tree data rather than a loose filesys­tem diff. For every tracked en­try, the check re­quired:

the same rel­a­tive path;

the same Git ob­ject type;

the same tree mode, in­clud­ing ex­e­cutable bits;

the same Git blob ID.

Matching Git blob IDs means the tracked file bytes are iden­ti­cal. The check cov­ered 12 re­pos and 96 tracked en­tries with zero mis­matches.

This repos­i­tory pre­serves the con­tents of those PoCs. Repository-level meta­data such as stars, is­sues, pull re­quests, re­leases, and sep­a­rate Git his­tory re­main in the orig­i­nal repos­i­tory his­to­ries.

Direct en­tries, in­clud­ing c-ares-tcp-uaf-calc-poc, ffm­peg-rasc-dlta-calc-poc, fire­fox-smartwin­dow-pri­vate-url-ex­fil-poc, floci-api­gate­way-vtl-rce-poc, lib­ssh2-cve-2026 – 55200-poc, lib­ssh2-pub­lickey-list-calc-poc, nghttp2-nghttpx-up­grade-queue-poi­son-poc, nmap-ipv6-extlen-wrap-poc, ph­p857-stream­bucket-soap-rce-rpoc, rust­desk-ses­sion-per­mis­sion-pocs, and sys­tem­in­former-phsvc-trusted-host-lpe-poc, are tracked by this repos­i­to­ry’s com­mit his­tory.

ABUSE

Do NOT, un­der any cir­cum­stances, use any ma­te­r­ial in this repos­i­tory ma­li­ciously. This is good-faith, open-dis­clo­sure vul­ner­a­bil­ity re­search in­tended to get more peo­ple in­ter­ested in ex­plor­ing this area of cy­ber­se­cu­rity.

Cybercrime is cringe.

DeepSpec/DSpark_paper.pdf at main · deepseek-ai/DeepSpec

github.com

AI CODE CREATIONGitHub CopilotWrite bet­ter code with AIGitHub Copilot ap­pDi­rect agents from is­sue to mergeMCP RegistryNewIntegrate ex­ter­nal tools­DE­VEL­OPER WORKFLOWSActionsAutomate any work­flow­Code­spacesIn­stant dev en­vi­ron­mentsIs­sue­s­Plan and track work­Code ReviewManage code change­sAP­PLI­CA­TION SECURITYGitHub Advanced SecurityFind and fix vul­ner­a­bil­i­ti­esCode se­cu­ri­ty­Se­cure your code as you build­Se­cret pro­tec­tion­Stop leaks be­fore they star­t­EX­PLOREWhy GitHubDocumentationBlogChangelogMarketplaceView all fea­tures

AI CODE CREATIONGitHub CopilotWrite bet­ter code with AIGitHub Copilot ap­pDi­rect agents from is­sue to mergeMCP RegistryNewIntegrate ex­ter­nal tools

AI CODE CREATION

GitHub CopilotWrite bet­ter code with AI

GitHub CopilotWrite bet­ter code with AI

GitHub Copilot ap­pDi­rect agents from is­sue to merge

GitHub Copilot ap­pDi­rect agents from is­sue to merge

MCP RegistryNewIntegrate ex­ter­nal tools

MCP RegistryNewIntegrate ex­ter­nal tools

DEVELOPER WORKFLOWSActionsAutomate any work­flow­Code­spacesIn­stant dev en­vi­ron­mentsIs­sue­s­Plan and track work­Code ReviewManage code changes

DEVELOPER WORKFLOWS

ActionsAutomate any work­flow

ActionsAutomate any work­flow

CodespacesInstant dev en­vi­ron­ments

CodespacesInstant dev en­vi­ron­ments

IssuesPlan and track work

IssuesPlan and track work

Code ReviewManage code changes

Code ReviewManage code changes

APPLICATION SECURITYGitHub Advanced SecurityFind and fix vul­ner­a­bil­i­ti­esCode se­cu­ri­ty­Se­cure your code as you build­Se­cret pro­tec­tion­Stop leaks be­fore they start

APPLICATION SECURITY

GitHub Advanced SecurityFind and fix vul­ner­a­bil­i­ties

GitHub Advanced SecurityFind and fix vul­ner­a­bil­i­ties

Code se­cu­ri­ty­Se­cure your code as you build

Code se­cu­ri­ty­Se­cure your code as you build

Secret pro­tec­tion­Stop leaks be­fore they start

Secret pro­tec­tion­Stop leaks be­fore they start

EXPLOREWhy GitHubDocumentationBlogChangelogMarketplace

EXPLORE

Why GitHub

Documentation

Blog

Changelog

Marketplace

View all fea­tures

BY COMPANY SIZEEnterprisesSmall and medium teamsStar­tup­sNon­prof­itsBY USE CASEApp ModernizationDevSecOpsDevOpsCI/CDView all use cas­esBY INDUSTRYHealthcareFinancial ser­vices­Man­u­fac­tur­ing­Gov­ern­mentView all in­dus­triesView all so­lu­tions

BY COMPANY SIZEEnterprisesSmall and medium teamsStar­tup­sNon­prof­its

BY COMPANY SIZE

Enterprises

Small and medium teams

Startups

Nonprofits

BY USE CASEApp ModernizationDevSecOpsDevOpsCI/CDView all use cases

BY USE CASE

App Modernization

DevSecOps

DevOps

CI/CD

View all use cases

BY INDUSTRYHealthcareFinancial ser­vices­Man­u­fac­tur­ing­Gov­ern­mentView all in­dus­tries

BY INDUSTRY

Healthcare

Financial ser­vices

Manufacturing

Government

View all in­dus­tries

View all so­lu­tions

EXPLORE BY TOPICAISoftware DevelopmentDevOpsSecurityView all top­ic­sEX­PLORE BY TYPECustomer sto­rie­sEv­ents & we­bi­na­rsE­books & re­ports­Busi­ness in­sights­GitHub SkillsSUPPORT & SERVICESDocumentationCustomer sup­port­Com­mu­nity fo­rumTrust cen­ter­Part­nersView all re­sources

EXPLORE BY TOPICAISoftware DevelopmentDevOpsSecurityView all top­ics

EXPLORE BY TOPIC

AI

Software Development

DevOps

Security

View all top­ics

EXPLORE BY TYPECustomer sto­rie­sEv­ents & we­bi­na­rsE­books & re­ports­Busi­ness in­sights­GitHub Skills

EXPLORE BY TYPE

Customer sto­ries

Events & we­bi­nars

Ebooks & re­ports

Business in­sights

GitHub Skills

SUPPORT & SERVICESDocumentationCustomer sup­port­Com­mu­nity fo­rumTrust cen­ter­Part­ners

SUPPORT & SERVICES

Documentation

Customer sup­port

Community fo­rum

Trust cen­ter

Partners

View all re­sources

COMMUNITYGitHub SponsorsFund open source de­vel­op­er­sPRO­GRAMSSe­cu­rity LabMaintainer CommunityAcceleratorGitHub StarsArchive ProgramREPOSITORIESTopicsTrendingCollections

COMMUNITYGitHub SponsorsFund open source de­vel­op­ers

COMMUNITY

GitHub SponsorsFund open source de­vel­op­ers

GitHub SponsorsFund open source de­vel­op­ers

PROGRAMSSecurity LabMaintainer CommunityAcceleratorGitHub StarsArchive Program

PROGRAMS

Security Lab

Maintainer Community

Accelerator

GitHub Stars

Archive Program

REPOSITORIESTopicsTrendingCollections

REPOSITORIES

Topics

Trending

Collections

ENTERPRISE SOLUTIONSEnterprise plat­for­mAI-pow­ered de­vel­oper plat­for­mAVAIL­ABLE ADD-ONSGitHub Advanced SecurityEnterprise-grade se­cu­rity fea­turesCopi­lot for BusinessEnterprise-grade AI fea­ture­sPremium SupportEnterprise-grade 24/7 sup­port

ENTERPRISE SOLUTIONSEnterprise plat­for­mAI-pow­ered de­vel­oper plat­form

ENTERPRISE SOLUTIONS

Daily links from Cory Doctorow

pluralistic.net

Today’s links

Zuckerberg’s in­creas­ingly bizarre war on whistle­blow­ers: Under no cir­cum­stances should you rush out and read the book that prompted Mark Zuckerberg to de­mand $111m and eter­nal auc­to­r­ial si­lence.

Hey look at this: Delights to delec­tate.

Object per­ma­nence: Flame war­riors; Cryptography and casi­nos; TSA v dy­ing 95 year old wom­an’s adult di­a­per; Neoliberalism and Brexit; Beyond so­lu­tion­ism; How Thiel cheated with his Roth; Inequality’s sta­bi­lizer; Palm Pilot school; Gillmor on PR flacks; How I Edited an Agricultural Paper; Conservative judge chokes lib­eral judge; Hollywoodnomics; Rubber fin­ger­tips v fin­ger­print read­ers; Snowden’s telep­res­ence ro­bot; Shrill”; Moral haz­ard, Three Rocks.”

Upcoming ap­pear­ances: London, Edinburgh, Sydney, Melbourne, Brighton, London, South Bend.

Recent ap­pear­ances: Where I’ve been.

Latest books: You keep read­in’ em, I’ll keep writ­in’ em.

Upcoming books: Like I said, I’ll keep writ­in’ em.

Colophon: All the rest.

Zuckerberg’s in­creas­ingly bizarre war on whistle­blow­ers (permalink)

More than a decade ago, a group of young, in­ter­net-con­nected Belarusian dis­si­dents launched a se­ries of in­creas­ingly high-stakes, in­creas­ingly sur­real con­fronta­tions with the cor­rupt, au­thor­i­tar­ian gov­ern­ment of Alexander Lukashenka, a man who is of­ten called the last Soviet dic­ta­tor.”

Lukashenka’s se­cret po­lice — still called the KGB — rou­tinely ter­ror­ize and kid­nap pro-democ­racy ac­tivists, and all forms of protest are banned. It was against the back­drop of this un­re­lent­ing op­pres­sion that the ac­tivists launched a se­ries of whim­si­cal flash mobs” that chal­lenged the Lukashenka regime’s will­ing­ness to crack down on even the most in­nocu­ous be­hav­ior.

One of these flash mobs was an ice cream so­cial: ac­tivists con­verged on a pub­lic square to eat ice cream cones. Lukashenka’s thugs beat them and dragged them away:

https://​web.archive.org/​web/​20070609164305/​http://​pics.live­jour­nal.com/​lito­ta_/​gallery/​0000bcch

The pro­tes­tors thought that by dar­ing Lukashenka to ar­rest peo­ple for eat­ing ice cream, they could cre­ate a win-win sit­u­a­tion: ei­ther Lukashenka would be re­vealed as the kind of ass­hole who thinks it should be il­le­gal to eat ice cream, or he’d be re­vealed as the kind of weak­ling who could­n’t keep a lid on dis­sent.

Lukashenka took the bait. And took it. And took it. In the years that fol­lowed, pro­test­ers would be ar­rested for smil­ing, clap­ping, and just stand­ing silently:

https://​www.in­dex­on­cen­sor­ship.org/​2011/​07/​be­larus-pro­test­ers-rally-on-the-web/

The world learned that Lukashenka was a buf­foon, and Belarusians af­firmed their view that this buf­foon would not hes­i­tate to mete out the most vi­cious pun­ish­ments for the most in­nocu­ous ac­tions:

https://​sci-hub.st/​10.1080/​25739638.2021.1928880

Speaking of thin-skinned, para­noid, wildly cor­rupt buf­foons who will stop at noth­ing to si­lence their en­e­mies, how about that Mark Zuckerberg, huh? Sure, all the head­lines these days are about Zuck’s in­ten­tion to trans­form Facebook into a sports bet­ting site:

https://​www.busi­nessin­sider.com/​metas-zucker­berg-en­ters-the-pre­dic­tion-mar­ket-arena-poly­mar­ket-2026 – 6

But in the UK, Zuckerberg’s war on whistle­blow­ers keeps find­ing new, ice cream grade depths of ab­sur­dity to plumb. The whistle­blower in ques­tion is, of course, Sarah Wynn-Williams, au­thor of the in­ter­na­tion­ally best­selling mem­oir Careless People, which de­tails the crim­i­nal­ity she wit­nesses dur­ing her years as the head of Facebook’s in­ter­na­tional re­la­tions team:

https://​plu­ral­is­tic.net/​2025/​04/​23/​zuck­er­streisand/#​zdgaf

Careless People is full of rev­e­la­tions about the gross in­sti­tu­tional mis­con­duct of Facebook, in­clud­ing its know­ing en­cour­age­ment of a geno­cide in Myanmar. But it’s also full of sto­ries about the se­vere per­sonal fail­ings of Facebook’s ex­ec­u­tive team, es­pe­cially Sheryl Sandberg, Joel Kaplan and Mark Zuckerberg.

These three come off as the most colos­sal of ass­holes, cruel, petty and preda­tory. Sandberg comes across as a sex­ual abuser who dreams of traf­fick­ing in poor peo­ple’s or­gans. Kaplan is an oaf whose plan to pro­vide paid in­ter­net ac­cess to refugee camps falls apart once he learns that refugees in camps don’t have any money (he also takes points off of Wynn-Williams’ work­place eval­u­a­tion for be­ing unresponsive” over a pe­riod when she was in a near-death coma). Worst of all, though, is Zuckerberg, whose sins range from cheat­ing at Settlers of Catan to en­dan­ger­ing the Colombian peace process af­ter a 50-year civil war be­cause he re­fused to get out of bed be­fore noon. Zuck is also re­vealed to have given the Chinese state ac­cess to all of Facebook and the power to cen­sor con­tent they dis­liked, as part of a failed bid to get per­mis­sion to of­fer a Facebook ser­vice in China.

It’s a ter­ri­ble com­pany, with aw­ful prod­ucts, run by the worst peo­ple. Wynn-Williams’ con­di­tions of em­ploy­ment re­quired her to sign a con­tract that bound her to si­lence (nondisclosure), for­bade her from speak­ing ill of the com­pany (nondisparagement), and de­nied her ac­cess to the le­gal sys­tem in all her deal­ings with Meta (binding ar­bi­tra­tion).

Together, these three clauses — rou­tinely used by Meta to si­lence would-be whistle­blow­ers — meant that af­ter Wynn-Williams’s book was pub­lished, Meta got its ar­bi­tra­tor — a lawyer who is paid by Meta to ad­ju­di­cate con­trac­tual dis­putes in­stead of an ac­tual judge — to or­der her to never pro­mote or even speak about her book.

The ar­bi­tra­tor awarded Meta $50,000 for each crit­i­cism that Wynn-Williams levied, quickly com­ing to a to­tal of over $11,000,000. This vastly ex­ceeds the as­sets and life­time earn­ing po­ten­tial of Wynn-Williams and her hus­band (a re­porter with the Financial Times). If this bill ever truly comes due, they will be wiped out.

Which raises an in­ter­est­ing ques­tion: what else can they do to her? Once they’ve se­cured civil dam­ages that ex­ceeds her net worth sev­eral times over, why should­n’t she just flout her agree­ment? Freedom’s just an­other word for noth­ing left to lose,” and all that.

Nevertheless, Wynn-Williams has scrupu­lously hewed to the ar­bi­tra­tor’s rules, stead­fastly re­main­ing silent about her book, its con­tents, and her ex­pe­ri­ences at Facebook/Meta. When she and I ap­peared on­stage to­gether in London for the launch for my book Enshittification last year, she fell silent and as­sumed a blank ex­pres­sion any time the sub­ject of Meta came up, and she did­n’t sign or sell books af­ter­ward:

https://​www.bar­bi­can.org.uk/​whats-on/​2025/​event/​cory-doc­torow-with-sarah-wynn-williams-chris-mor­ris

When she won the British Book Award, she did not speak to ac­cept it, and the cover of her book was blurred out on the over­head screen (she gave an ac­cep­tance speech on be­half of her co-win­ner, the late Virginia Giuffre, who was abused by Jeffrey Epstein and who ac­cused Prince Andrew of sex­ual as­sault):

https://​www.the­guardian.com/​books/​2026/​may/​11/​sarah-wynn-williams-and-vir­ginia-giuf­fre-jointly-win-free­dom-to-pub­lish-prize-at-british-book-awards

Nevertheless, when she was booked to speak — about a sub­ject other than her book — at the Hay Festival on a stage with Tim Wu and Carole Cadwalladr, Meta sent a le­gal threat to the fes­ti­val and Wynn-Williams, claim­ing that if by speak­ing about any­thing in pub­lic, she would vi­o­late the ar­bi­tra­tor’s or­der. Accordingly, Wynn-Williams main­tained to­tal si­lence and a blank fa­cial ex­pres­sion for an hour on stage, say­ing not one word, while Wu and Cadwalladr car­ried on a dis­cus­sion. Careless People was with­drawn from the fes­ti­val book­shop on the days she ap­peared there:

https://​www.the­guardian.com/​tech­nol­ogy/​2026/​may/​31/​meta-le­gal-ac­tion-forces-face­book-whistle­blower-to-stay-silent-at-hay-fes­ti­val

Nevertheless, Meta has in­formed Wynn-Williams that her silent, mo­tion­less ap­pear­ance on a stage con­sti­tutes a fur­ther breach of her agreement” and that they are go­ing to seek even more dam­ages from her. This act of anti-ice cream thug­gery has pushed Wynn-Williams over the edge and now she’s sued to in­val­i­date her con­tract:

https://​www.the­guardian.com/​tech­nol­ogy/​2026/​jun/​25/​whistle­blower-sarah-wynn-williams-sues-meta-at­tempts-to-si­lence-her-care­less-peo­ple

Her lawyers have posted their doc­u­ments re­lated to the suit, in­clud­ing a 285-page de­c­la­ra­tion by Wynn-Williams ex­plain­ing the great lengths she’s gone to in or­der to com­ply with Meta’s de­mands, and the com­pa­ny’s ab­solute in­tran­si­gence and ar­bi­trary men­ace:

https://​katzbanks.com/​sarah-wynn-williams-meta-law­suit-doc­u­ments/

Why would Meta be so in­tent on de­stroy­ing this one high-pro­file whistle­blower? Surely they’ve heard of the Streisand Effect. There is no bet­ter way to en­sure that Wynn-Williams’ book (already a NYT #1 best­seller) con­tin­ues to at­tract read­ers than to con­tinue to es­ca­late these threats.

I think they’re per­fectly aware that they are con­vinc­ing more peo­ple to read Careless People (you should read it, it’s gen­uinely ex­cel­lent):

https://​us.macmil­lan.com/​books/​9781250391230/​care­less­peo­ple/

But I think they’ve de­cided that this is a price worth pay­ing, be­cause:

a) They’ve done even worse things since Wynn-Williams parted ways with the com­pany; and

b) They’re lay­ing off thou­sands of work­ers be­cause their gi­ant bet on AI has been a flop, leav­ing them with a mas­sive cash crunch; and

c) By de­stroy­ing Sarah Wynn-Williams, they can ter­ror­ize all those thou­sands of bit­ter ex-em­ploy­ees into si­lence about the even graver sins the com­pany has com­mit­ted.

That’s my the­ory, any­way:

https://​www.busi­nessin­sider.com/​meta-lay­offs-man­agers-soft­ware-en­gi­neers-ai-spend­ing-2026 – 6

Lukashenka knew that ar­rest­ing chil­dren for eat­ing ice cream would make him a laugh­ing­stock abroad. Zuckerberg knows that threat­en­ing Wynn-Williams for stand­ing in wooden si­lence on a stage makes him look like his­to­ry’s most guil­lotine­able bil­lion­aire. But both Lukashenka and Zuckerberg are will­ing to be thought a thin-skinned bully, so long as that means the peo­ple they op­press the most are too ter­ri­fied to ever chal­lenge their au­thor­ity.

Hey look at this (permalink)

You can’t make bil­lions with­out hurt­ing peo­ple https://​www.the­guardian.com/​tech­nol­ogy/​2026/​jun/​24/​cory-doc­torow-on-elon-musk-ai-bub­ble-bosses-cruel-fan­tasies

Cargo Culture https://​www.wheresy­oured.at/​cargo-cul­ture/

Cargo Culture https://​www.wheresy­oured.at/​cargo-cul­ture/

How Do You Beat an Oligarchy? One Bite at a Time. https://​www.the­bignewslet­ter.com/​p/​how-do-you-beat-an-oli­garchy-one

How Do You Beat an Oligarchy? One Bite at a Time. https://​www.the­bignewslet­ter.com/​p/​how-do-you-beat-an-oli­garchy-one

WIKIPEDIA WORKERS TO SEEK UNION RECOGNITION https://​www.cwu.org/​press_re­lease/​wikipedia-work­ers-to-seek-union-recog­ni­tion/

WIKIPEDIA WORKERS TO SEEK UNION RECOGNITION https://​www.cwu.org/​press_re­lease/​wikipedia-work­ers-to-seek-union-recog­ni­tion/

A Reasonable Analysis of the Social Web https://​ri­versee­ber.net/​blog/​post/​a-rea­son­able-analy­sis-of-the-so­cial-web/

A Reasonable Analysis of the Social Web https://​ri­versee­ber.net/​blog/​post/​a-rea­son­able-analy­sis-of-the-so­cial-web/

Object per­ma­nence (permalink)

#25yrsago Actual mu­sic piracy https://​www.the­guardian.com/​uk/​2001/​jun/​13/​ukcrime.nick­hop­kins

#25yrsago Flame war­riors https://​web.archive.org/​web/​20010603044914/​http://​www.win­ter­net.com/~​mikelr/​flame1.html

#25yrsago World court says Arizona mur­dered German pris­on­ers by deny­ing them con­sular ac­cess https://​www.cnn.com/​2001/​WORLD/​eu­rope/​06/​27/​ger­many.court/​in­dex.html

#25yrsago Private school buys every stu­dent a Palm Pilot https://​web.archive.org/​web/​20010709075203/​https://​www.wired.com/​news/​school/​0,1383,44812,00.html

#25yrsago Dan Gillmor’s guide for PR flacks https://​web.archive.org/​web/​20010626230530/​http://​web.sil­i­con­va­l­ley.com/​con­tent/​sv/​2001/​02/​20/​opin­ion/​dg­ill­mor/​weblog/​PR.htm

#20yrsago German pub­lisher at­tacks Bulgarian books-for-blind site https://​web.archive.org/​web/​20060629065445/​https://​protest.bloghub.org/​2006/​06/​27/​fight-for-copy­rights-in-bul­garia-turns-ugly/

#20yrsago Photographer calls crit­ic’s boss to com­plain https://​www.flickr.com/​pho­tos/​thomashawk/​176785431/

#20yrsago Daddle: a kid-sized sad­dle for adults https://​web.archive.org/​web/​20060618012713/​https://​www.cashel­com­pany.com/​dad.php

#20yrsago More on cryp­tog­ra­phy and on­line casi­nos https://​memex.craphound.com/​2006/​06/​26/​more-on-crypto-and-on­line-casi­nos/

#20yrsago Reasons that HD DVD for­mats have al­ready failed https://​www.au­dio­holics.com/​ed­i­to­ri­als/​10-rea­sons-why-high-de­f­i­n­i­tion-dvd-for­mats-have-al­ready-failed

#15yrsago Undercover video from North Korea: starv­ing chil­dren, hun­gry sol­diers https://​web.archive.org/​web/​20110629182200/​http://​www.abc.net.au/​news/​sto­ries/​2011/​06/​27/​3253979.htm

#15yrsago TSA asked 95 year old woman in a wheel­chair in ter­mi­nal stage of leukemia to re­move adult di­a­per for pat-down https://​web.archive.org/​web/​20110627091434/​http://​www.nwf­dai­lynews.com/​news/​mother-41324-search-adult.html

#15yrsago Reading of Mark Twain’s How I Edited an Agricultural Paper” https://​ia801406.us.archive.org/​22/​items/​Cory_­Doc­torow_Pod­cast_209/​Cory_­Doc­torow_Pod­cast_209_­Mark_T­wain_Edit­ing_an_A­gri­cul­tur­al_­Pa­per-fixed.mp3

#15yrsago Paramount sends copy­right no­tice to Shapeways user over 3D print­able Super 8 cube https://​tod­dblatt.blogspot.com/​2011/​06/​cease-and-de­sist.html

#15yrsago Advice Goddess: How much longer must we be sub­jected to in­va­sive TSA pat­downs? https://​www.ad­vice­god­dess.com/​archives/​2011/​06/​24/​i_­think_y­oure_c.html

#15yrsago Conservative Wisconsin Supreme Court Justice al­leged to have choked lib­eral col­league https://​talk­ing­pointsmemo.com/​muck­raker/​wis-jus­tice-ann-walsh-bradley-jus­tice-prosser-put-his-hands-around-my-neck-in-anger-in-a-choke­hold

#15yrsago Hollywoodonomics: how Harry Potter and The Order of the Phoenix lost” $167M https://​dead­line.com/​2010/​07/​stu­dio-shame-even-harry-pot­ter-pic-loses-money-be­cause-of-warner-bros-phony-baloney-ac­count­ing-51886/

#10yrsago I’m pro­filed in the Globe and Mail Report on Business mag­a­zine https://​web.archive.org/​web/​20160628142940/​https://​www.the­globe­and­mail.com/​re­port-on-busi­ness/​rob-mag­a­zine/​the-cru­sader-fight­ing-lock-happy-en­ter­tain­ment-con­glom­er­ates/​ar­ti­cle30520282/

#10yrsago Rubber fin­ger­tips to use with fin­ger­print-based au­then­ti­ca­tion sys­tems https://​www.csmon­i­tor.com/​World/​Pass­code/​Se­cu­rity-cul­ture/​2016/​0627/​Fake-fin­ger­prints-The-lat­est-tac­tic-for-pro­tect­ing-pri­vacy

#10yrsago How I grilled the best steaks I’ve ever eaten https://​memex.craphound.com/​2016/​06/​27/​how-i-grilled-the-best-steaks-ive-ever-eaten/

#10yrsago Supreme Court strikes down Texas abor­tion law https://​www.nbc­news.com/​news/​us-news/​supreme-court-strikes-down-strict-abor­tion-law-n583001?cid=sm_tw

#10yrsago Snowden’s flesh is trapped in Russia, but his mind roams the world in a ro­bot body https://​ny­mag.com/​in­tel­li­gencer/​2016/​06/​ed­ward-snow­den-life-as-a-ro­bot.html

#10yrsago China’s $10B/year PR min­istry mired in po­lit­i­cal fight with anti-cor­rup­tion/​loy­alty en­forcers https://​web.archive.org/​web/​20160701235749/​http://​www.econ­o­mist.com/​news/​china/​21701169-xi-jin­ping-sends-his-spin-doc­tors-spin­ning-who-draws-party-line?fsrc=scn/​tw/​te/​pe/​ed/​who­draw­sthep­arty­line

#10yrsago Snowden pub­licly con­demns Russia’s pro­posed sur­veil­lance law https://​www.the­guardian.com/​world/​2016/​jun/​26/​rus­sia-passes-big-brother-anti-ter­ror-laws

#10yrsago Yes Men punk the NRA with buy one gun, give one gun” pro­gram https://​www.youtube.com/​watch?v=Ik­b66V2rDcw

#10yrsago Shrill: Lindy West’s amaz­ing, laugh-aloud mem­oir about fat­ness, abor­tion, trolls and rape-jokes https://​memex.craphound.com/​2016/​06/​27/​shrill-lindy-wests-amaz­ing-laugh-aloud-mem­oir-about-fat­ness-abor­tion-trolls-and-rape-jokes/

#10yrsago Neoliberalism, Brexit (and Bernie) https://​crooked­tim­ber.org/​2016/​06/​26/​trib­al­ism-trumps-ne­olib­er­al­ism/

#10yrsago McDonald’s 1987 fash­ion cat­a­log is a hor­ror­show https://​www.flickr.com/​pho­tos/​ja­son­liebigstuff/​3050116620/

#10yrsago Beyond solutionism”: what role can tech­nol­ogy play in solv­ing deep so­cial prob­lems https://​ethanzuck­er­man.com/​2016/​06/​22/​the-worst-thing-i-read-this-year-and-what-it-taught-me-or-can-we-de­sign-so­ciotech­ni­cal-sys­tems-that-dont-suck/

#10yrsago Donald Trump’s an­no­tated Walk of Fame star https://​ddu­ane.tum­blr.com/​post/​146444083461/​someome-spray-painted-the-mute-sign-on-don­ald

#5yrsago New York City’s 100 worst land­lords https://​plu­ral­is­tic.net/​2021/​06/​26/​wax-roth­ful/#​nyc-land­lords

#5yrsago How Peter Thiel gamed the Roth IRA for tax-free bil­lions https://​plu­ral­is­tic.net/​2021/​06/​26/​wax-roth­ful/#​thiels-gam­bit

#5yrsago The Overlapping Infrastructure of Urban Surveillance https://​plu­ral­is­tic.net/​2021/​06/​26/​wax-roth­ful/#​sur­veil­lance-in­fo­graphic

#5yrsago The Doctrine of Moral Hazard https://​plu­ral­is­tic.net/​2021/​06/​27/​the-doc­trine-of-moral-haz­ard/

#1yrago Bill Griffith’s Three Rocks’ https://​plu­ral­is­tic.net/​2025/​06/​27/​the-snap­per/#​9-to-107-spikes

#1yrago Surveillance is in­equal­i­ty’s sta­bi­lizer https://​plu­ral­is­tic.net/​2025/​06/​26/​au­tosta­bi­lizer/#​slicey-bois

Upcoming ap­pear­ances (permalink)

London: Idler Festival, Jul 11 https://​www.idler.co.uk/​fes­ti­val/

Edinburgh International Book Festival with Jimmy Wales, Aug 17 https://​www.ed­book­fest.co.uk/​events/​the-front-list-cory-doc­torow-and-jimmy-wales

Edinburgh International Book Festival with Jimmy Wales, Aug 17 https://​www.ed­book­fest.co.uk/​events/​the-front-list-cory-doc­torow-and-jimmy-wales

Fintech Engineering Handbook

w.pitula.me

Welcome to the Fintech Engineering Handbook. This re­source aims to de­scribe the most im­por­tant pat­terns used in soft­ware en­gi­neer­ing, where money is the pri­mary fo­cus of the sys­tem. It can be read in full to get a com­pre­hen­sive un­der­stand­ing or in parts when deal­ing with a par­tic­u­lar prob­lem.

For whom?

People join­ing fin­tech. To get fa­mil­iar with the do­main and the pat­terns that make money sys­tems trust­wor­thy.

People al­ready in fin­tech. As a ref­er­ence to reach for when fac­ing a par­tic­u­lar prob­lem, and a shared vo­cab­u­lary to point col­leagues at.

People out­side fin­tech. To un­der­stand how build­ing for money dif­fers from what they’re used to, and why.

It’s meant as a liv­ing doc­u­ment and con­tri­bu­tions are wel­comed.

Principles

Everything you will read be­low is a way to ad­here to the three prin­ci­ples:

No in­vented data. Money can’t be cre­ated out of nowhere, so we can’t tol­er­ate du­pli­cates or ar­bi­trary bal­ance up­dates. We en­force this with idem­po­tency, dedu­pli­ca­tion and rec­on­cil­i­a­tion.

No lost data. Everything that hap­pens to money has to be tracked and per­sisted. We pro­tect this with full pre­ci­sion, at-least-once de­liv­er­ies, event sourc­ing, au­dit trails and im­mutabil­ity.

No trust. Trust nei­ther ex­ter­nal providers, in­ter­nal com­po­nents, nor the world. We up­hold this by ver­i­fy­ing web­hooks, cross-check­ing data across sources and fail­ing loudly on bro­ken as­sump­tions.

Representing money

Before you can move or record money, you have to rep­re­sent it. These are the de­ci­sions about how a mon­e­tary value is mod­eled, stored, com­puted and con­verted. Getting them wrong means every layer above in­her­its the er­ror.

Precision han­dling

Money rep­re­sen­ta­tion is one of the most fun­da­men­tal de­ci­sions in fi­nan­cial sys­tems. There are four pri­mary ways to do it:

Floating-point. Built-in float or dou­ble types. This can cre­ate un­pre­dictable pre­ci­sion losses and is al­most never a good idea. But it’s the fastest and most mem­ory ef­fi­cient, and re­quires no ad­di­tional li­braries or data struc­tures.

Arbitrary pre­ci­sion. Types like Java’s BigDecimal let you con­trol the pre­ci­sion of a com­pu­ta­tion pre­cisely. The code is pre­dictable and we get to de­cide where and how round­ing hap­pens. It fits in­ter­me­di­ate work like FX or pric­ing math, where many op­er­a­tions chain to­gether.

Minor-units pre­ci­sion. For most fiat cur­ren­cies it’s ok to keep only a fixed pre­ci­sion, the same that is used in the con­nected cen­tral bank­ing sys­tem. The num­ber of dig­its is de­scribed by ISO 4217 (don’t as­sume it’s al­ways 2, it’s not!). In prac­tice this means stor­ing the amount as an in­te­ger in its small­est unit - €12.34 be­comes 1234. Crypto uses the same in­te­ger-small­est-unit idea (satoshis for BTC, wei for ETH), but with two twists: the pre­ci­sion is per-as­set and de­fined by the to­ken it­self (e.g. an ERC-20’s dec­i­mals), of­ten 18 dig­its, and the re­sult­ing mag­ni­tudes over­flow 64-bit in­te­gers, so you need ar­bi­trary-width in­te­gers to hold them.

Rational num­bers. When no pre­ci­sion loss is ac­cept­able. This is the most pow­er­ful ap­proach but comes with its own caveats. First, it’s slower than the al­ter­na­tives. Second, it can­not be con­verted to other for­mats with­out los­ing pre­ci­sion. Third, it usu­ally re­quires a cus­tom datatype or a li­brary.

Selecting one or the other de­pends on the class of the sys­tem and its re­spon­si­bil­i­ties. There is no rule of thumb here, other than not us­ing float­ing points. These rep­re­sen­ta­tions are not mu­tu­ally ex­clu­sive ei­ther - how you store an amount and how you com­pute with it are sep­a­rate de­ci­sions, and a sys­tem of­ten com­bines them, e.g. in­te­ger stor­age with BigDecimal for in­ter­me­di­ate com­pu­ta­tion.

The same care ap­plies when an amount is be­ing se­ri­al­ized. A bare JSON num­ber is an IEEE-754 dou­ble in most parsers, so se­ri­al­iz­ing money as a num­ber rein­tro­duces the float­ing-point prob­lem at the edge, no mat­ter how care­fully you rep­re­sent it in­ter­nally. Send money ei­ther as a string (“12.34”) or as an in­te­ger in its small­est unit.

Principles touched:

No lost data. The wrong rep­re­sen­ta­tion silently drops pre­ci­sion that can never be re­cov­ered.

Rounding strate­gies

Rounding is in­evitable. It should be done ex­plic­itly: any di­vi­sion, cur­rency con­ver­sion, fee, in­ter­est or rate ap­pli­ca­tion, or move be­tween pre­ci­sions might re­quire round­ing.

It’s a busi­ness de­ci­sion. Different round­ing strate­gies have dif­fer­ent im­pli­ca­tions. Sometimes you have to be con­ser­v­a­tive (e.g. not to spend what you don’t have) and round down; some­times you care about sta­tis­ti­cal ef­fects and use half-even. Deciding who gets the frac­tion might have le­gal/​tax im­pli­ca­tions.

Round as sel­dom as pos­si­ble. The longer you keep full pre­ci­sion, the more op­tions you have to make the right de­ci­sion in the right con­text. Rounding should usu­ally hap­pen on bound­aries, e.g. be­fore num­bers are per­sisted or shown to the user.

Rounding breaks sums. If a num­ber is split into parts and round­ing is ap­plied, the sum of the parts might no longer equal the orig­i­nal num­ber. Depending on the con­text, this might re­quire ex­plicit han­dling - e.g. an ex­plicit round­ing ac­count.

Principles touched:

No lost data. Residuals must be tracked, not dropped.

No in­vented data. Rounding must never mint money that was­n’t there.

Currency han­dling

Money can’t be rep­re­sented as a num­ber alone - it comes paired with a cur­rency. There are a few nu­ances when it comes to han­dling cur­ren­cies.

Pack amount and cur­rency to­gether. A Money new­type (struct, class, record etc.) min­i­mizes the chance of er­rors.

No cross-cur­rency arith­metic. Your sys­tem should pro­hibit adding two amounts in dif­fer­ent cur­ren­cies. Conversion should hap­pen very ex­plic­itly with a strictly con­trolled rate.

Use a con­trolled cur­rency set. A cus­tom con­fig en­try, JDK data­base, ded­i­cated ser­vice. Never ac­cept ar­bi­trary cur­rency codes; val­i­date at the bound­aries of the sys­tem.

Codes iden­tify fiat only. Currency codes are unique and us­able as iden­ti­fiers only for fiat. For crypto cur­ren­cies you will have to use a more com­pli­cated ap­proach like (network, con­tract ad­dress) or sim­i­lar.

Currencies carry meta­data. Symbol, pre­ci­sion, name, etc. You will usu­ally need those de­tails for dis­play pur­poses but rarely for busi­ness logic.

Pegged is not the un­der­ly­ing. Pegged, bridged and wrapped crypto cur­ren­cies are not equiv­a­lent to the un­der­ly­ing ones.

Principles touched:

No trust. Validate cur­rency against the con­trolled set at the bound­ary.

No in­vented data. Treating dis­tinct cur­ren­cies/​as­sets as in­ter­change­able con­jures value.

FX Rates

FX (Forex, for­eign ex­change cur­rency mar­ket) rates al­low us to con­vert money be­tween cur­ren­cies.

A rate is al­ways di­rec­tional. The EUR/USD rate is not the same thing as the in­verted USD/EUR rate. On an ex­change, buy­ing and sell­ing are two dif­fer­ent or­ders at dif­fer­ent prices (the bid/​ask spread), so the two di­rec­tions don’t sim­ply in­vert.

The time of the rate is crit­i­cal. While you can tech­ni­cally use a rate from any point in time, the most com­monly used are:

Current-time rate. Used to cal­cu­late cur­rent hold­ings or the value of a trans­ac­tion as if it hap­pened right now. Value-date rate. Used to cal­cu­late change in value or a tax amount.

Current-time rate. Used to cal­cu­late cur­rent hold­ings or the value of a trans­ac­tion as if it hap­pened right now.

Value-date rate. Used to cal­cu­late change in value or a tax amount.

Two kinds of rate mat­ter for con­ver­sion:

Transactional rate. The rate a real con­ver­sion hap­pened at. You don’t store it di­rectly - it falls out of the orig­i­nal and re­sult amounts. Reference rate (mid-market or cen­tral bank). One used for val­u­a­tion and equiv­a­lence (what hold­ings are worth right now, or a tax base at the value date) and not a price any­one ac­tu­ally trades at.

Transactional rate. The rate a real con­ver­sion hap­pened at. You don’t store it di­rectly - it falls out of the orig­i­nal and re­sult amounts.

Reference rate (mid-market or cen­tral bank). One used for val­u­a­tion and equiv­a­lence (what hold­ings are worth right now, or a tax base at the value date) and not a price any­one ac­tu­ally trades at.

There is no canon­i­cal rate. Rates come from mar­kets and vary be­tween venues or cal­cu­la­tion meth­ods. The clos­est to canon­i­cal are cen­tral bank rates, which can be used only as a ref­er­ence rate, and even there we can have al­ter­na­tive sources which are just as valid.

Principles touched:

No lost data. Keep the amounts (and, for ref­er­ence rates, a way back to the source).

No trust. There’s no canon­i­cal rate, so the source should be part of the data.

Recording money: the ledger

Once rep­re­sented, money move­ments have to be recorded in a way that bal­ances, sur­vives au­dit and can be re­con­structed years later. This is where the books, their time­stamps and their his­tory live.

Double-entry book­keep­ing

Double-entry book­keep­ing is a widely used way to store fi­nan­cial trans­ac­tions as a list of en­tries in the form of (credit ac­count, debit ac­count, amount) (this is a com­pact form; the clas­sic rep­re­sen­ta­tion uses a sep­a­rate debit and credit row per move­ment). Because every en­try moves the same amount out of one ac­count and into an­other, the books al­ways bal­ance - money is only moved, never cre­ated or de­stroyed.

Money al­ways has a source and a des­ti­na­tion. External providers get ded­i­cated ac­counts too, so money en­ter­ing/​leav­ing the sys­tem is still tracked.

Balance is never stored. It’s de­rived from the move­ments of money.

Accounts have a type. Assets, li­a­bil­i­ties or eq­uity, so the ac­count­ing equa­tion (assets = li­a­bil­i­ties + eq­uity) holds and each ac­count has a de­fined side on which it in­creases. In prac­tice you also need in­come (revenue) and ex­pense ac­counts - e.g. to book a fee as rev­enue or a write-off as a loss (assets = li­a­bil­i­ties + eq­uity + rev­enue - ex­penses).

One trans­ac­tion, many move­ments. A sin­gle trans­ac­tion will usu­ally cre­ate mul­ti­ple move­ments, e.g. one for the net amount, an­other for the fees.

Posted en­tries are im­mutable. By con­ven­tion, cor­rec­tions are made by adding new com­pen­sat­ing en­tries that off­set the orig­i­nal.

Principles touched:

No in­vented data. Money only ever moves be­tween ac­counts; the to­tal is con­served.

Value time vs book­ing time vs set­tle­ment time

Transactions will usu­ally have at least two, some­times three time­stamps as­so­ci­ated:

Value time. When the trans­ac­tion oc­curred.

Booking time. When the trans­ac­tion was recorded in the sys­tem.

Settlement time. When money was ac­tu­ally trans­ferred or ma­te­ri­al­ized. Not every trans­ac­tion has one. Usually ex­pressed as T+X, where X is the num­ber of days af­ter value at which set­tle­ment hap­pens (e.g. T+2 means 2 days af­ter value).

The first two will al­most al­ways di­verge:

Backdated (booking > value). Technically al­most all trans­ac­tions are back­dated, but the term is most im­pact­ful when book­ing and value time fall un­der dif­fer­ent re­port­ing pe­ri­ods, e.g. days, months, years.

Forward-dated (booking < value). Less fre­quent, but hap­pens e.g. with sched­uled or fu­ture-dated pay­ments - a stand­ing or­der recorded to­day but ef­fec­tive next week.

Example: a card pay­ment hap­pened at T1 (value time), you recorded it at T2 (booking time), but the pay­ment provider trans­ferred money to your ac­count at T3 (settlement time).

Business and busi­ness-con­sumed re­ports usu­ally care about value or set­tle­ment time, while book­ing time is use­ful for trace­abil­ity.

Principles touched:

No lost data. Record every rel­e­vant time­stamp; col­laps­ing them into a sin­gle cre­at­ed_at loses in­for­ma­tion you can’t re­con­struct later.

Audits and au­dit trails

Financial sys­tems are sub­ject to reg­u­la­tory scrutiny in the form of var­i­ous au­dits. Some of the things that might be ver­i­fied dur­ing an au­dit:

are com­pany funds not com­min­gled with user funds or used for com­pany ex­penses?

are all rev­enues reg­is­tered, re­ported and ex­plain­able? E.g. can you pin­point the trans­ac­tions that con­tributed to a par­tic­u­lar rev­enue stream in a par­tic­u­lar pe­riod?

is the in­for­ma­tion pro­vided to the ex­ter­nal world (e.g. users or the tax of­fice) match­ing re­al­ity? E.g. does the com­pany hold as much in as­sets as it owes its users?

are the funds pro­tected against ex­ter­nal threats? (e.g. who can ac­cess the funds and how)

To an­swer those and many other ques­tions, fi­nan­cial sys­tems have to keep track of not only the cur­rent state but the full his­tory of how that state came to be. This his­tory is the au­dit trail: a record of every­thing that hap­pened, de­tailed enough that any bal­ance, re­port or de­ci­sion can be ex­plained and re­pro­duced from it.

A use­ful au­dit trail cap­tures, for every change:

What hap­pened.

When it hap­pened (see value time vs book­ing time).

Who or what trig­gered it - a user, an op­er­a­tor, an au­to­mated job.

Why it hap­pened - a ref­er­ence to the or­der, in­struc­tion or in­ci­dent that caused it.

Money move­ments are the ob­vi­ous sub­ject, but man­ual in­ter­ven­tions, con­fig­u­ra­tion changes (fee sched­ules, rate sources, lim­its) and per­mis­sion changes need trails too.

The why is of­ten it­self the out­put of a de­ci­sion (e.g. a com­pli­ance check or risk score). Recording just the out­come (“blocked”) rarely sat­is­fies an au­dit be­cause you’ll be asked how that out­come was reached. If that logic lives in a de­ci­sion table or a rules en­gine (DMN, Drools, Decisions4s) in­stead of be­ing buried in im­per­a­tive code, the de­ci­sion be­comes a struc­tured, re­playable ar­ti­fact that says which rules fired, on which in­puts, with what re­sult.

Principles touched:

No lost data. Current state alone can’t an­swer an au­dit’s ques­tions; only the full his­tory can.

Event sourc­ing

Event sourc­ing is prob­a­bly the most prin­ci­pled and sys­temic ap­proach to build­ing an au­dit trail. In ES, in­stead of stor­ing cur­rent state with a log next to it, you store only the events and de­rive state from them. The dou­ble-en­try ledger is an ex­am­ple of this pat­tern ap­plied to money - bal­ance is never stored, it is cal­cu­lated from the stored en­tries. With this ap­proach the trail is a pri­mary ar­ti­fact and can­not drift away from re­al­ity.

A few prac­ti­cal notes:

You don’t need it every­where. The ledger al­ready cov­ers money; for sur­round­ing do­mains a con­ven­tional model with a re­li­able change log may be enough.

The Case for Physical Media Ownership

dervis.de

Digital Purchases Often Mean Licensed Access

drmWhen a dig­i­tal store la­bels a movie, game, or book as a pur­chase, the trans­ac­tion is usu­ally a re­vo­ca­ble li­cense rather than own­er­ship of the file. The store and rights holder re­tain sub­stan­tial con­trol. [1]

drmA Blu-ray disc, game car­tridge, or printed book gen­er­ally can­not be re­moved from a shelf by a re­mote pol­icy change. It can be owned, resold, lent, archived, or used of­fline.

re­movalIf a dig­i­tal store shuts down, loses dis­tri­b­u­tion rights, or changes its pol­icy, a pur­chased item can be re­moved from an ac­count.

dr­mDig­i­tal store­fronts gen­er­ally sell ac­cess rather than prop­erty. If the ser­vice or ac­count re­la­tion­ship ends, ac­cess to the li­brary can end with it.

dr­mIn 2013, Microsoft an­nounced that the Xbox One would re­quire 24-hour on­line check-ins and would block used game sales. The back­lash prompted Microsoft to re­verse every re­stric­tion be­fore launch. [1]

dr­mIn 2011, the startup ReDigi launched a mar­ket­place for used” dig­i­tal iTunes tracks. Capitol Records sued shortly af­ter, and in December 2018 the US Court of Appeals for the Second Circuit ruled that the first-sale doc­trine, which al­lows re­sale of law­fully made phys­i­cal copies, does not ap­ply to dig­i­tal files. The de­ci­sion con­firmed that dig­i­tal re­sale is treated dif­fer­ently from phys­i­cal re­sale. [1]

drmA class ac­tion law­suit filed in 2022 in Washington fed­eral court ac­cused Amazon of fraud for us­ing a Buy” but­ton when cus­tomers were ac­tu­ally pur­chas­ing re­vo­ca­ble li­censes. A 2020 law­suit raised the same is­sue, but a California judge dis­missed it in 2021 be­cause the plain­tiff had never ac­tu­ally lost ac­cess to her pur­chased videos, leav­ing her with­out stand­ing. A sep­a­rate law­suit was filed in August 2025 by Lisa Reingold, who lost ac­cess to con­tent she had paid $20.79 for. The cases ar­gue Amazon vi­o­lated con­sumer pro­tec­tion laws by mis­rep­re­sent­ing the na­ture of Prime Video pur­chases. [1] [2] [3]

pric­ing­Phys­i­cal me­dia can have re­sale value. A fin­ished game can be sold, a film can be traded, and a book can be lent. Digital li­censes are usu­ally locked to an ac­count and non-trans­fer­able, so the pur­chase price typ­i­cally can­not be re­cov­ered through re­sale.

pricingA game car­tridge, Blu-ray, or vinyl record may re­tain sec­ondary-mar­ket value. A dig­i­tal li­cense gen­er­ally can­not be resold or trans­ferred, and a re­voked li­cense has no re­sale value.

dr­mOf­fline me­dia such as a disc, book, or record re­quires no ac­count, pass­word, two-fac­tor au­then­ti­ca­tion, or Terms of Service up­date. Access does not de­pend on ac­count sta­tus, pol­icy changes, or the con­tin­ued op­er­a­tion of a provider.

Content Can Be Removed

re­moval­Be­tween 2023 and 2025, Disney+ re­moved dozens of orig­i­nal films and shows. In 2023, the com­pany recorded an im­pair­ment charge of $1.5 bil­lion af­ter re­mov­ing over 50 ti­tles from Disney+ and Hulu, in­clud­ing Willow and Crater, as part of a broader cost-re­duc­tion ef­fort. Crater, a $54 mil­lion film re­leased on Disney+ on May 12, 2023, was re­moved on June 30, 2023. In September 2024, Disney re­moved ad­di­tional ti­tles in­clud­ing Togo and A Small Light. [1] [2]

re­moval­Warner Bros. Discovery re­moved 87 ti­tles from HBO Max in 2022 and 2023, in­clud­ing fin­ished films it did not re­lease else­where. The re­movals in­cluded an­i­mated se­ries such as Infinity Train and Summer Camp Island. (Infinity Train was later re­leased on Max and Tubi.) [1]

re­movalIn 2023, Sony an­nounced it would re­move Discovery con­tent from the PlayStation Store on December 31, 2023: 1,318 sea­sons of pur­chased con­tent sched­uled for re­moval. When Sony stopped sell­ing dig­i­tal video in 2021, it had told cus­tomers they would con­tinue to have ac­cess to their pur­chased li­braries. After pub­lic crit­i­cism, Sony re­versed the de­ci­sion and the con­tent was ul­ti­mately not re­moved. [1] [2]

re­movalIn June 2026, Sony no­ti­fied PlayStation users in the UK that all pur­chased Studio Canal ti­tles would be re­moved from their video li­braries on September 1, 2026, cit­ing con­tent li­cens­ing agree­ments. The com­pany of­fered no re­funds or com­pen­sa­tion. Some coun­tries, in­clud­ing Germany and Austria, had al­ready lost ac­cess to pur­chased Studio Canal con­tent in 2022. [1]

re­movalKon­ami’s P.T. demo was re­moved from the PlayStation Store in 2015 af­ter the can­cel­la­tion of Silent Hills. After a brief win­dow, even peo­ple who had al­ready down­loaded it could not re­in­stall it. PS4 con­soles with P.T. still in­stalled ap­peared on eBay with ask­ing prices above $1,500, be­fore eBay re­moved the list­ings cit­ing copy­right con­cerns. [1]

re­movalScott Pilgrim vs. the World: The Game dis­ap­peared from Xbox and PlayStation stores in December 2014 when a li­cense ex­pired. Players cam­paigned for years be­fore a re­mas­tered edi­tion ar­rived in 2021. [1] [2]

re­movalAc­tivi­sion’s Deadpool game was delisted in December 2013 when its Marvel li­cense ex­pired, re­turned in July 2015 along­side the film, and was delisted again in November 2017 when the li­cense ex­pired a sec­ond time. [1]

re­moval­When Telltale Games col­lapsed in 2018, many of its ti­tles were re­moved from sale. Some were later re­stored, while oth­ers re­main un­avail­able be­cause of li­cens­ing is­sues. [1]

re­movalIn October 2021, Rockstar re­moved the orig­i­nal PC ver­sions of GTA III, Vice City, and San Andreas from dig­i­tal stores ahead of the Definitive Edition re­mas­ter launch. The re­moval made player mods, saved games, and com­mu­nity tools built around the orig­i­nal re­leases harder to ac­cess. The re­mas­ter omit­ted around 24 li­censed tracks (8 from Vice City and 16 from San Andreas). Rockstar even­tu­ally re­stored the orig­i­nals af­ter crit­i­cism from the com­mu­nity, but only through its own launcher. [1]

re­movalOn June 23, 2023, Paramount+ can­celed and re­moved Star Trek: Prodigy. Netflix later picked up the se­ries, but Paramount+ sub­scribers lost ac­cess to the orig­i­nal stream­ing home and their view­ing his­tory. [1] [2]

re­movalA­ma­zon Prime Video has re­moved pur­chased films and TV shows from user li­braries when li­cens­ing agree­ments ex­pired, in­clud­ing for cus­tomers who re­ceived pur­chase con­fir­ma­tion emails. The Buy” but­ton on Prime Video refers to a re­vo­ca­ble li­cense tied to rights agree­ments. [1]

re­movalIn December 2023, Apple re­leased iOS 17.2 and re­moved the abil­ity to pur­chase or rent movies and TV shows through the iTunes Store app on iPhone and iPad. iTunes had sold tele­vi­sion shows since 2005 and movies since 2008. Customers who had built video li­braries through iTunes over that pe­riod found the pur­chase mech­a­nism re­moved from de­vices they al­ready owned. [1]

re­movalDig­i­tal stores of­ten delist orig­i­nal re­leases when re­mas­ters launch. Dark Souls: Prepare to Die Edition was re­moved from Steam when the Remastered ver­sion launched in 2018. Players who pre­ferred the orig­i­nal’s mul­ti­player or mod com­pat­i­bil­ity had to buy the new ver­sion or lo­cate a phys­i­cal copy. [1]

re­moval­Net­flix has re­moved over 250 of its own Original movies and shows over time, in­clud­ing Daredevil, Jessica Jones, Luke Cage, The Defenders, The Punisher, Voltron: Legendary Defender, Longmire, Hemlock Grove, and Babylon Berlin (a German se­ries that aired on Sky but was mar­keted as a Netflix Original in the US, Canada, and Australia, and was re­moved in February 2024), some­times af­ter the ti­tles had been avail­able for years. [1]

re­moval­cen­sor­shipIn September 2024, YouTube Music lost ac­cess to songs by Adele, Nirvana, Green Day, Kendrick Lamar, Bob Dylan, R.E.M., and Britney Spears, among many oth­ers, due to a li­cens­ing dis­pute with SESAC. Users in the US saw blocks on hun­dreds of mu­sic videos and tracks with the mes­sage This video con­tains con­tent from SESAC. It is not avail­able in your coun­try.” YouTube even­tu­ally re­stored the mu­sic af­ter reach­ing a new agree­ment. [1]

re­movalEpic Games no­ti­fied cus­tomers that Dark and Darker would be re­moved from their Epic Games Store li­braries on November 1, 2025. As of that date, the plat­form no longer launched the game for af­fected users. [1]

Digital Stores Can Shut Down

re­movalserversMi­crosoft shut down its ebook store in July 2019, re­mov­ing pur­chased ebooks from users’ li­braries and is­su­ing re­funds. In 2025, Microsoft stopped sell­ing movies and TV shows through its store, though pre­vi­ously pur­chased con­tent re­mained ac­ces­si­ble. [1]

re­movalservers­Google Play Music shut down in December 2020 and was re­placed by YouTube Music. Not all user li­braries sur­vived the tran­si­tion in­tact. [1]

re­movalserver­sNin­tendo closed the 3DS and Wii U eS­hop for new pur­chases on March 27, 2023. Roughly 1,000 dig­i­tal-only games are no longer avail­able for pur­chase across both plat­forms, and re­down­loads may not re­main avail­able in­def­i­nitely. [1]

re­movalserver­s­The Wii Shop Channel shut down on January 30, 2019 (late January 31 in some time zones), end­ing new ac­cess to hun­dreds of WiiWare and Virtual Console ti­tles, in­clud­ing 427 Virtual Console games in North America and the WiiWare cat­a­log. Many of these games were never re­leased phys­i­cally and are not cur­rently avail­able through of­fi­cial chan­nels. [1]

re­movalservers­Google Stadia, a cloud gam­ing ser­vice where pur­chased games could only be streamed, shut down in January 2023, just over three years af­ter launch. Access de­pended on Google’s servers, so the ser­vice clo­sure ended ac­cess to the games. Google is­sued re­funds. [1]

re­movalserver­sUl­tra­vi­o­let, a cloud-based digital locker” for movies, shut down on July 31, 2019. Users re­ceived a lim­ited win­dow to move their li­braries to Movies Anywhere. Those who missed the dead­line or lived in un­sup­ported re­gions lost ac­cess to films linked to their ac­counts. [1]

re­movalserversIn April 2024, Sony shut down Funimation and merged users into Crunchyroll. Funimation had pro­moted dig­i­tal copies bun­dled with pur­chased Blu-rays as per­ma­nently avail­able. When the ser­vice closed on April 2, 2024, those dig­i­tal copies be­came un­avail­able. Crunchyroll con­firmed it did not sup­port Funimation dig­i­tal copies, leav­ing cus­tomers who had re­deemed codes un­able to use pre­vi­ously pur­chased con­tent. [1]

drm­re­movalMi­crosoft’s PlaysForSure DRM launched in 2004 as a cer­ti­fi­ca­tion logo for com­pat­i­ble de­vices, then was su­per­seded in 2006 when Microsoft launched the Zune plat­form, which used a pro­pri­etary ser­vice in­com­pat­i­ble with PlaysForSure de­vices. Microsoft shut down PlaysForSure DRM au­tho­riza­tion servers in 2008, ren­der­ing pre­vi­ously pur­chased files un­playable. In 2015, Microsoft shut down the Zune mar­ket­place, leav­ing users with DRM-locked files they could no longer au­then­ti­cate. [1]

re­moval­When a dig­i­tal ser­vice shuts down, con­sumers gen­er­ally re­ceive an an­nounce­ment and a dead­line. Bankruptcy or shut­down processes rarely pre­serve ac­cess to dig­i­tal pur­chases.

Subscriptions Can Become More Expensive

pric­ingNet­flix has raised sub­scrip­tion prices re­peat­edly across tiers in 2017, 2018, 2019, 2020, 2021, 2022, and 2025, while also chang­ing plan struc­tures, in­tro­duc­ing ad­ver­tis­ing to some plans, and re­strict­ing pass­word shar­ing. The Standard plan went from $9.99 in 2015 to $15.49 in January 2022, a roughly 55% in­crease. [1]

pricingA house­hold sub­scrib­ing to sev­eral stream­ing ser­vices can ex­ceed $80 per month. [1]

pricin­gAdobe’s Creative Cloud All Apps plan launched in 2012 at $49.99 per month. In June 2025, Adobe au­to­mat­i­cally mi­grated sub­scribers to a new Creative Cloud Pro” tier at $69.99 per month, a roughly 40% in­crease over 13 years. The change bun­dled gen­er­a­tive AI fea­tures; users who did not want the in­crease had to switch to a lower-tier plan. [1] [2]

pric­ing­Sub­scrip­tions re­quire con­tin­u­ing pay­ment for con­tin­u­ing ac­cess. If pay­ment stops, the li­brary is usu­ally no longer avail­able. Blu-ray has no re­cur­ring ac­cess fee af­ter pur­chase.

pric­ingStream­ing ser­vices can elim­i­nate grand­fa­thered pric­ing. Subscribers who signed up at lower tiers may be re­quired to move to a more ex­pen­sive tier or lose ac­cess. Discs have no re­cur­ring plan terms af­ter pur­chase.

qual­i­typricingA stan­dard Blu-ray disc de­liv­ers video at up to 40 Mbps with loss­less au­dio, while 4K Ultra HD Blu-rays run at 50 to 128 Mbps with HDR and near-loss­less en­cod­ing. Netflix 4K streams typ­i­cally run at 15 to 30 Mbps with com­pressed au­dio. The phys­i­cal disc car­ries more pic­ture and au­dio data than many stream­ing ver­sions. [1]

re­moval­pric­ingStream­ing con­tent can be re­moved be­cause of li­cens­ing or ser­vice-pol­icy changes, and sub­scribers typ­i­cally re­ceive no re­fund or backup copy.

Streaming and Disc Quality Differ

qual­i­tyNet­flix 4K streams typ­i­cally run at 15 to 30 Mbps us­ing com­pressed video. A 4K Ultra HD Blu-ray disc runs at 50 to 128 Mbps with near-loss­less en­cod­ing. The same film on both for­mats can carry sub­stan­tially dif­fer­ent amounts of pic­ture data. Streaming pri­or­i­tizes band­width ef­fi­ciency; discs gen­er­ally use higher bi­trates. [1]

qual­ity­Lossy com­pres­sion can cre­ate vis­i­ble ar­ti­facts: band­ing in sky gra­di­ents, mac­roblock­ing in dark scenes, and smeared fine de­tail in hair and fab­ric. These ar­ti­facts come from band­width-ef­fi­cient en­cod­ing rather than the dis­play. Blu-ray en­codes typ­i­cally al­lo­cate more data to the im­age. [1]

qual­i­tyS­tream­ing au­dio is com­monly com­pressed as Dolby Digital Plus or AAC. A Blu-ray can carry loss­less Dolby TrueHD, DTS-HD Master Audio, or un­com­pressed PCM. On ca­pa­ble equip­ment, that can pro­duce an au­di­ble dif­fer­ence. [1]

qual­i­tyS­tream­ing qual­ity can fluc­tu­ate with in­ter­net con­nec­tion, router con­ges­tion, and net­work man­age­ment. A phys­i­cal disc plays at a fixed lo­cal bi­trate, with no buffer­ing or adap­tive res­o­lu­tion changes.

qual­i­tycen­sor­ship­Film grain, a de­lib­er­ate choice by cin­e­matog­ra­phers, has his­tor­i­cally been re­duced by stream­ing en­coders to save band­width. Modern stream­ing ser­vices use in­creas­ingly so­phis­ti­cated tech­niques, in­clud­ing AI mod­el­ing to syn­the­size film tex­ture rather than sim­ply re­mov­ing it. Earlier en­codes of­ten re­moved grain, and the re­sult­ing im­age may not re­flect the di­rec­tor’s orig­i­nal in­tent. A Blu-ray can pre­serve grain and tex­ture from a par­tic­u­lar re­lease with­out later stream-side re­pro­cess­ing. [1]

Alteration and Remote Deletion

cen­sor­shipremovalIn July 2009, Amazon re­motely re­moved pur­chased copies of George Orwell’s 1984 and Animal Farm from cus­tomers’ Kindles. Amazon is­sued re­funds, but the books and reader notes were re­moved from de­vices. CEO Jeff Bezos later called the move stupid.” [1]

cen­sor­shipDig­i­tal ver­sions of films, games, and books can be edited af­ter re­lease. Disney+ has changed scenes in clas­sic films, in­clud­ing the Star Wars orig­i­nal tril­ogy, where shots such as Greedo shoot­ing first were al­tered and new tran­si­tions were in­serted be­fore the orig­i­nal ti­tle crawls. The changes drew crit­i­cism from film me­dia. [1]

cen­sor­shipremoval­When Rockstar re­leased GTA: The Trilogy - The Definitive Edition in 2021, the re­mas­ter omit­ted around 24 li­censed tracks from Vice City (8 songs) and San Andreas (16 songs), re­moved cheat codes, and re­moved San Andreas’s co-op mul­ti­player. Rockstar re­moved the orig­i­nal ver­sions first. Players who wanted the orig­i­nal re­leases had to lo­cate PlayStation 2 discs or use mod­i­fied PC ex­e­cuta­bles. [1]

cen­sor­shipIn 2023, Puffin Books re­leased edited ver­sions of Roald Dahl’s books, mod­i­fy­ing lan­guage re­lated to weight, race, and gen­der. Both phys­i­cal and dig­i­tal edi­tions were af­fected. Physical copies of the orig­i­nal text still ex­ist, but dig­i­tal edi­tions can be up­dated re­motely by the pub­lisher at any time. [1]

cen­sor­ship­Phys­i­cal me­dia pre­serves the ver­sion pressed at the time. A Blu-ray pressed in 2015 still has the same cut, color, and au­dio mix in 2035. It is not changed by later re­mote up­dates.

cen­sor­ship­dr­mDig­i­tal plat­forms can re­strict ac­cess by re­gion or de­vice type. A disc can be used in a com­pat­i­ble player with­out re­quir­ing an in­ter­net con­nec­tion, ac­count lo­gin, or ac­cep­tance of up­dated terms.

Cloud Storage Depends on Providers

drm­cen­sor­shipA Google ac­count ban can af­fect more than Gmail, in­clud­ing Google Drive, Google Photos, Google Docs, YouTube, and Play Store pur­chases. Users have re­ported los­ing ac­cess to years of doc­u­ments, pho­tos, and pur­chased apps af­ter au­to­mated sys­tems flagged their ac­counts, some­times with lim­ited ex­pla­na­tion or re­course. [1]

pric­ingservers­For six years, Google Photos of­fered unlimited free stor­age” for com­pressed pho­tos. In June 2021, Google ended that pol­icy. Every photo since then counts against a 15GB cap shared across Gmail, Drive, and Photos. Users who built li­braries un­der the prior pol­icy had to man­age stor­age lim­its or pay for ad­di­tional ca­pac­ity. [1]

cen­sor­ship­Cloud stor­age providers can scan files, sus­pend ac­counts, or re­move files un­der their poli­cies. In 2022, a fa­ther took med­ical pho­tos of his young son’s in­jury for a doc­tor. Google’s au­to­mated sys­tems flagged the im­ages as CSAM, locked his Google ac­count, and re­ported him to po­lice. The in­ves­ti­ga­tion took roughly ten months be­fore po­lice cleared him, but Google re­fused to re­store his ac­count, leav­ing him with­out ac­cess to ten years of emails, pho­tos, and doc­u­ments. [1]

cen­sor­shipremovalIn 2020, Twitch re­ceived a large num­ber of DMCA take­down no­tices from mu­sic la­bels cov­er­ing stream­ers’ archives of clips and VODs. Thousands of cre­ators re­ceived copy­right strikes and re­moved years of con­tent to avoid ac­count bans. Some stream­ers re­ported hav­ing tens of thou­sands of clips to re­move. The strikes tar­geted con­tent dat­ing back to 2017 – 2019, archives that stream­ers had lim­ited abil­ity to re­view in ad­vance. Under the DMCAs safe har­bor pro­vi­sions, Twitch bore re­spon­si­bil­ity for re­mov­ing con­tent af­ter re­ceiv­ing no­tices. Streamers bore the bur­den of iden­ti­fy­ing and delet­ing their own archives, or fac­ing ac­count sus­pen­sion. [1]

serversIn 2012, Dropbox was hacked and the cre­den­tials of 68 mil­lion ac­counts were ex­posed. The com­pany did not dis­close the full ex­tent un­til 2016, four years later. In 2011, a code bug al­lowed any­one to ac­cess any Dropbox ac­count with­out a pass­word for four hours: 25 mil­lion users were af­fected. [1]

cen­sor­shipremovalThe same prin­ci­ple ap­plies to cre­ator plat­forms. Twitch, YouTube, and sim­i­lar ser­vices can re­move or de­mon­e­tize con­tent based on au­to­mated claims, al­go­rith­mic flags, or rights holder re­quests, some­times be­fore cre­ators have a mean­ing­ful op­por­tu­nity to re­spond.

drm­cen­sor­ship­Cloud stor­age Terms of Service grant providers the right to scan files, re­move con­tent they deem ob­jec­tion­able, and ter­mi­nate ac­counts for pol­icy vi­o­la­tions. Google Drive, Dropbox, and iCloud all re­serve broad en­force­ment rights when con­tent or shar­ing ac­tiv­ity vi­o­lates their terms. [1]

re­movalserver­sAdobe dis­con­tin­ued its Creative Cloud Synced Files fea­ture, end­ing cloud sync and re­mov­ing cloud-stored copies. While lo­cal files in the Creative Cloud Files folder re­mained on users’ de­vices, the change broke work­flows that re­lied on cloud sync and shar­ing. Users who had treated the ser­vice as their pri­mary backup or col­lab­o­ra­tion tool needed to mi­grate to al­ter­na­tive stor­age so­lu­tions. [1]

pricingEx­ter­nal hard dri­ves, NAS sys­tems, and Blu-ray back­ups have no monthly fee and do not scan files or change ac­cess terms. They can still be af­fected by hard­ware fail­ure, theft, or user er­ror, but they are not tied to provider ac­count sta­tus.

re­movalserversIn 2023, Google said it would start delet­ing ac­counts that had been in­ac­tive for two years, in­clud­ing every­thing in Gmail, Drive, Photos, and YouTube. That pol­icy took ef­fect in December 2023, when Google be­gan per­ma­nently delet­ing in­ac­tive ac­counts and all their con­tents. Years of stored data can be deleted af­ter a pe­riod of in­ac­tiv­ity. [1]

drmWhen you watch Netflix, the plat­form tracks when you pause, rewind, what de­vice you use, how long you watch, and when. Netflix uses this data to in­form con­tent pro­duc­tion, li­cens­ing de­ci­sions, and rec­om­men­da­tions. [1]

dr­mXbox Game Pass, PlayStation Plus, and sim­i­lar ser­vices track your game­play in de­tail: what you play, for how long, where you get stuck, and what you do next. Microsoft uses that game­play data to build ad­ver­tis­ing pro­files and per­son­al­ize rec­om­men­da­tions. Gameplay data be­comes part of an ad­ver­tis­ing pro­file. [1] [2]

drm­Stream­ing ser­vices have faced law­suits al­leg­ing they share or sell view­ing data with ad­ver­tis­ers and data bro­kers. In 2026, Texas Attorney General Ken Paxton sued Netflix for al­legedly track­ing and sell­ing user view­ing data to data bro­kers, in­clud­ing data from chil­dren. Research has re­peat­edly shown that anonymized” datasets can of­ten be re-iden­ti­fied when com­bined with other data sources. Offline play­back of a Blu-ray cre­ates no view­ing record with a stream­ing provider. [1]

re­movalserver­sWhen you store data in the cloud, you are re­ly­ing on a com­pany to main­tain ac­cess in­def­i­nitely. When that com­pany changes its pol­icy, goes out of busi­ness, or deletes your ac­count, your data be­comes in­ac­ces­si­ble.

Books and Music Face Similar Risks

re­movalIn 2019, Myspace lost about 50 mil­lion songs up­loaded be­tween 2003 and 2015 dur­ing a server mi­gra­tion. Myspace ini­tially de­scribed the is­sue as a tem­po­rary bug but later ac­knowl­edged the data was un­re­cov­er­able. Much of that in­de­pen­dent mu­sic ex­isted only on Myspace’s servers. [1]

re­movalIn May 2023, Spotify re­moved tens of thou­sands of tracks gen­er­ated by the AI mu­sic tool Boomy, re­mov­ing roughly 7% of Boomy’s cat­a­log on the plat­form due to sus­pected artificial stream­ing” by bots. Artists who had built a fol­low­ing on those tracks lost streams and fol­lower counts as­so­ci­ated with them. [1]

re­movalIn March 2021, Spotify re­moved mu­sic from Kakao Entertainment dur­ing a li­cens­ing dis­pute. Listeners lost ac­cess to af­fected artists un­til the com­pa­nies reached a new agree­ment days later. [1]

re­movalIn January 2022, Neil Young re­moved his cat­a­log from Spotify to protest the plat­form host­ing Joe Rogan’s pod­cast. Fans with cu­rated playlists and lis­ten­ing his­to­ries around his mu­sic lost ac­cess while the cat­a­log was un­avail­able. (Young even­tu­ally re­turned to Spotify in 2024 af­ter reach­ing a new agree­ment.) [1]

re­movalIn 2025, mul­ti­ple artists in­clud­ing King Gizzard & the Lizard Wizard and Hotline TNT re­moved their cat­a­logs from Spotify and other stream­ing plat­forms. For lis­ten­ers who had built li­braries around those artists, the cat­a­logs were no longer avail­able in those ser­vices. [1]

drm­Li­brary ebooks through OverDrive and Libby use DRM with fixed loan pe­ri­ods. Titles ex­pire au­to­mat­i­cally at the end of the lend­ing pe­riod and can no longer be opened, even if the reader has not fin­ished. Holds and wait­lists ap­ply to dig­i­tal files just as they do to phys­i­cal copies. [1] [2]

pric­ing­When Apple Music launched in 2015, Taylor Swift re­fused to put her al­bum 1989 on the ser­vice be­cause Apple was­n’t pay­ing artists dur­ing the free trial. Apple re­versed the pol­icy the fol­low­ing day. [1]

pric­ingSpo­ti­fy’s ef­fec­tive pay­out av­er­ages roughly $0.003 to $0.005 per stream, though Spotify it­self notes it cal­cu­lates roy­al­ties based on streamshare rather than a fixed per-stream rate, mean­ing ef­fec­tive rates vary widely by lis­tener, re­gion, and sub­scrip­tion type. By con­trast, Bandcamp pays artists roughly 82% of each sale. A di­rect $10 al­bum sale can ex­ceed rev­enue from thou­sands of streams. Buying mu­sic or books di­rectly from artists, whether phys­i­cal or DRM-free dig­i­tal, is one of the most di­rect ways to sup­port them. [1] [2]

dr­mAudi­ble, Amazon’s au­dio­book plat­form, locks pur­chases to Amazon’s app with pro­pri­etary DRM. An Audible book can­not be moved to a non-Ama­zon player, backed up in­de­pen­dently, or played if ac­cess is with­drawn. The pur­chase re­mains locked to Amazon’s plat­form. [1]

qual­i­ty­drmA CD or vinyl record does not de­pend on a li­cens­ing agree­ment or cor­po­rate de­ci­sion to re­main playable. A printed book does not re­quire server au­then­ti­ca­tion. DRM-free dig­i­tal down­loads from Bandcamp and artists’ own stores of­fer more con­trol than most al­ter­na­tives: you re­ceive a file you can back up and play in­de­pen­dently. Even so, these re­main li­censes rather than trans­fers of own­er­ship. Most main­stream dig­i­tal stores pro­vide ac­cess, not prop­erty.

Game Preservation Is Uneven

re­movalA 2023 study found that 87% of games re­leased in the US be­fore 2010 are no longer for sale. They are un­avail­able through nor­mal com­mer­cial chan­nels and may be at risk of be­ing lost. For sys­tems such as the Commodore 64 and Game Boy, only a small frac­tion of their cat­a­logs re­main com­mer­cially avail­able to­day. [1]

re­movalserver­sWhen City of Heroes shut down in 2012 af­ter eight years, NCSoft ended ac­cess to a per­sis­tent vir­tual world. Thousands of play­ers lost char­ac­ters they had de­vel­oped over years. The game re­mained ac­ces­si­ble only be­cause fans re­verse-en­gi­neered the server pro­to­col and op­er­ated pri­vate servers, a so­lu­tion of un­cer­tain le­gal sta­tus and cul­tural value. [1]

ser­versEA’s Darkspore be­came un­playable in 2016 when its al­ways-on­line servers were shut down. Owners of the phys­i­cal disc were un­able to launch the game. [1]

cen­sor­shipIn 2024, Nintendo sued the Yuzu team, which main­tained a Switch em­u­la­tor, and shut down the pro­ject. The same de­vel­op­ers had also main­tained Citra, a 3DS em­u­la­tor, which went of­fline around the same time. This oc­curred just months af­ter Nintendo closed the 3DS eS­hop, leav­ing few le­gal op­tions for ac­cess­ing hun­dreds of 3DS-only games. [1]

drmThe DMCA makes it il­le­gal to by­pass DRM for preser­va­tion. In 2024, the U.S. Copyright Office re­jected a pro­posed ex­emp­tion from the Video Game History Foundation that would have let mu­se­ums and archives make games avail­able to re­searchers re­motely. [1]

re­movalThe Flashpoint Archive has col­lected over 150,000 Flash apps to pre­serve them af­ter Adobe’s shut­down. The Internet Archive em­u­lates thou­sands of retro games. [1]

re­moval­Lim­ited Run Games, Special Reserve Games, and Strictly Limited make phys­i­cal car­tridges and discs for games that were first re­leased dig­i­tally. [1]

cen­sor­shipIn 2024, Nintendo won a $2.4 mil­lion set­tle­ment from the Yuzu em­u­la­tor team. In 2021, Nintendo won a $2.1 mil­lion judg­ment against the RomUniverse ROM site. Both were multi-mil­lion dol­lar judg­ments tar­get­ing sites dis­trib­ut­ing pi­rated Nintendo games. Many of those games were not avail­able for le­gal pur­chase at the time. [1]

re­movalIn March 2025, Nintendo con­firmed it would re­move Super Formation Soccer from the Nintendo Switch Online retro li­brary: the first time a game had been delisted from the ser­vice af­ter launch. Since NSOs launch in 2018, Nintendo had con­sis­tently pre­sented the retro cat­a­log as a grow­ing col­lec­tion. That fram­ing qui­etly changed. [1]

re­movalThe Atari 2600 li­brary rep­re­sented a foun­da­tional era in gam­ing. In 1983, Atari dis­posed of ap­prox­i­mately 728,000 un­sold car­tridges in a New Mexico land­fill, a fig­ure later con­firmed by the for­mer man­ager who over­saw the bur­ial. The in­ci­dent be­came a widely cited sym­bol of the 1983 video game crash. Cartridges from this era were mass-pro­duced con­sumer goods with fi­nite lifes­pans, and many have since de­te­ri­o­rated or been lost, con­tribut­ing to gaps in the his­tor­i­cal record. [1]

drm­re­movalThe Internet Archive has saved mil­lions of out-of-print books and au­dio record­ings. For video games, the le­gal bar­ri­ers to dig­i­tal preser­va­tion are sub­stan­tial. The DMCA bans break­ing DRM even for some preser­va­tion pur­poses, and copy­right law does not give dig­i­tal files the same re­sale rights as phys­i­cal ones. Physical car­tridges can be pre­served, stud­ied, and played through or­di­nary use and archival han­dling. [1]

re­moval­Some games that were never com­mer­cially re­leased sur­vive only in frag­ments: fo­rum dis­cus­sions, mag­a­zine screen­shots, and the rec­ol­lec­tions of those who en­coun­tered them. Each func­tional phys­i­cal copy pre­serves a piece of gam­ing his­tory that might oth­er­wise be­come in­ac­ces­si­ble.

Server Shutdowns Can End Access

re­movalserversIn March 2024, Ubisoft shut down the servers for The Crew and re­moved ac­cess from li­braries, in­clud­ing for disc own­ers. The game re­quired an al­ways-on­line con­nec­tion to start. The shut­down prompted the found­ing of Stop Killing Games, a cam­paign chal­leng­ing the prac­tice of ren­der­ing pur­chased games un­playable through server shut­downs. [1]

IP Crawl — open webcam catalog

ipcrawl.com

A liv­ing at­las of open we­b­cams dis­cov­ered on the pub­lic in­ter­net — browse, fil­ter and watch them live from the edge.

A liv­ing at­las of open we­b­cams dis­cov­ered on the pub­lic in­ter­net — browse, fil­ter and watch them live from the edge.

Check if any cam­era near you is ex­posed. Less than 10 sec­onds. No lo­gin re­quired.

Streaming services’ obnoxiously loud ads become illegal on July 1 in California

arstechnica.com

The Motion Picture Association, which in­cludes Netflix, Disney, Amazon Prime Video, and Paramount, and the Streaming Innovation Alliance, which in­cludes Netflix, Disney, Peacock, and Pluto TV, op­posed the bill. The groups ar­gued that many” stream­ing ser­vices were al­ready try­ing to man­age the loudness of ad­ver­tise­ments that come from server-side ad in­ser­tion that may be in­con­sis­tent with the loud­ness of the pro­grams,” per a state Assembly analy­sis (PDF) from September 2025. Server-side ads can have dif­fer­ing vol­umes due to com­pa­nies us­ing var­i­ous en­cod­ing pipelines.

Additionally, as the op­pos­ing groups pre­vi­ously pointed out, stream­ing ser­vices must con­tend with a broad range of out­put de­vices, in­clud­ing TVs, tablets, and phones.

Reporting on how stream­ing ser­vices might fol­low the California law, trade pub­li­ca­tion TV Tech in December re­ported: Streaming providers will need to in­te­grate file-based and, in some cases, real-time pro­cess­ing and loud­ness con­trol into their server-side com­mer­cial in­ser­tion work­flow, just as they cur­rently do for their pri­mary pro­gram­ming.”

The ob­sta­cles in man­ag­ing the loud­ness of ads are un­der­scored when con­sid­er­ing the dis­sat­is­fac­tion that re­mains among broad­cast, ca­ble, and satel­lite view­ers. The FCC said it re­ceived at least” 1,700 com­plaints about this in 2024, about 825 in 2023, and ap­prox­i­mately 750 in 2022.

403 Forbidden

spectrum.ieee.org

Error 403 Forbidden

Forbidden

Error 54113

Details: cache-lga21933-LGA 1782627884 2337890602

Varnish cache server

Asian AI startups launch Mythos-like models as Anthropic’s export ban drags on

techcrunch.com

On Wednesday, Chinese cy­ber­se­cu­rity firm 360 re­port­edly un­veiled Tulongfeng, an AI tool it says can go head-to-head with Anthropic’s Mythos. That’s the cy­ber­se­cu­rity-fo­cused AI model that is re­port­edly so pow­er­ful, the Trump Administration has cur­rently banned it and its more re­stricted ver­sion, Fable 5, from the hands of non-Amer­i­cans.

Earlier the same week Sakana AI, a Tokyo-based AI startup launched Fugu, a model named af­ter the Japanese word for blow­fish. The com­pany says this fron­tier AI model stands shoul­der-to-shoul­der with lead­ing mod­els like Anthropic’s Fable 5 and Mythos Preview.” It is also de­signed for agents, with an abil­ity to or­ches­trate ac­cess to other mod­els though their APIs.

The two new Asian model prod­ucts come as the U.S. gov­ern­men­t’s ban drags on. It’s or­der that pre­vents Anthropic from global ac­cess to Mythos and Fable oc­curred two weeks ago.

A spokesper­son at Sakana AI told TechCrunch that re­lease of its new model was entirely co­in­ci­den­tal,” yet that has­n’t stopped it from cap­i­tal­iz­ing on the mo­ment. It’s web­site ad­ver­tises delivering fron­tier ca­pa­bil­ity with­out the risk of ex­port con­trols.”

Sakana Fugu is some­thing we have been build­ing since last year — the re­search be­hind it was pre­sented at ICLR this spring, and it re­flects an ap­proach that is cen­tral to how we de­liver fron­tier-level value at Sakana AI. We were con­fi­dent in the prod­uct on its own mer­its; the tim­ing sim­ply hap­pened to co­in­cide with a mo­ment that brought it more at­ten­tion than we ex­pected,” the spokesper­son said about launch­ing dur­ing the Mythos/Fable ex­port ban.

Sakana, co-founded in 2023 by for­mer Google re­searchers Ren Ito,  Llion Jones and David Ha, makes af­ford­able gen­er­a­tive AI mod­els that work well with small datasets and are op­ti­mized for the Japanese lan­guage and cul­ture.

While the com­pany is tar­get­ing Fugu at Japanese busi­nesses and gov­ern­ment agen­cies look­ing to re­duce their ex­po­sure to tight­en­ing ex­port con­trols, it is­n’t yet pro­claim­ing a last­ing shift away from U.S. AI in Asia.

U.S. mod­els re­main im­por­tant to Asia,” the spokesper­son said, a view con­sis­tent with re­marks co-founder Ren Ito made at the G7 sum­mit in Evian last week, where AI ac­cess and ex­port con­trols were one of the cen­tral top­ics. We’d char­ac­ter­ize the cur­rent mo­ment in those terms rather than as a per­ma­nent re­align­ment to­ward any one set of play­ers.”

Sakana co-founder Ren Ito elab­o­rated on that view in an op-ed pub­lished in the Project Syndicate last week. He urged the US fed­eral gov­ern­ment, that con­sider that its first pri­or­ity should be to pre­serve ac­cess,” for America’s clos­est al­lies, and ar­gued that AI should not be­come a tech­nol­ogy that is hoarded; it should be one that is de­vel­oped to­gether.”

David Ha, co-founder and CEO of Sakana, de­scribed Fugu as more than just a land grab dur­ing a vul­ner­a­ble mo­ment for a US com­peti­tors. It is de­signed to co­or­di­nate agent us­age among many mod­els.

Orchestration Models are the next fron­tier, be­yond big­ger mod­els,” he wrote on X. Relying on a sin­gle provider for na­tional in­fra­struc­ture, he ar­gued, is a risk the re­cent ex­port con­trols made im­pos­si­ble to ig­nore.

Access to top mod­els can dis­ap­pear overnight,” he wrote. Collective in­tel­li­gence is the prac­ti­cal hedge against this con­cen­tra­tion of power.”

While Tokyo-based Sakana po­si­tioned Fugu as a hedge strat­egy, a way to pre­serve ac­cess to fron­tier AI, not re­place it, China’s 360 was­n’t hedg­ing.

The Chinese firm re­port­edly un­veiled two AI se­cu­rity tools. Tulongfeng is de­signed to au­to­mat­i­cally dis­cover soft­ware vul­ner­a­bil­i­ties, and Yitianzhen is built to au­to­mate cy­ber de­fence and in­ci­dent re­sponse.

The prod­uct launch, how­ever, came with a mes­sage. According to Reuters, 360’s founder Zhou Hongyi de­scribed vul­ner­a­bil­ity-find­ing AI as a na­tional strate­gic as­set, and flagged what he called the risk of one-way trans­parency”, a sit­u­a­tion in which some ac­tors could ac­cess ad­vanced vul­ner­a­bil­ity-de­tec­tion ca­pa­bil­i­ties while oth­ers could not.

Anthropic had been on a his­toric growth tra­jec­tory. The US AI lab said its run-rate rev­enue crossed $47 bil­lion in May 2026. How much of that de­pends on Asian en­ter­prise cus­tomers is not pub­licly known.

But in the weeks since the ex­port or­der took ef­fect, at least two com­pa­nies, one in Tokyo, one in Beijing, have stepped into the space it left be­hind. Even if US com­pa­nies could win back trust should this ban ever end, lo­cal al­ter­na­tives, trained to bet­ter un­der­stand lo­cal lan­guage and nu­ance, are al­ready fill­ing the gap.

360 did not re­spond to a re­quest for com­ment.

When you pur­chase through links in our ar­ti­cles, we may earn a small com­mis­sion. This does­n’t af­fect our ed­i­to­r­ial in­de­pen­dence.

Kate Park is a re­porter at TechCrunch, with a fo­cus on tech­nol­ogy, star­tups and ven­ture cap­i­tal in Asia. She pre­vi­ously was a fi­nan­cial jour­nal­ist at Mergermarket cov­er­ing M&A, pri­vate eq­uity and ven­ture cap­i­tal.

View Bio

Linux on Older Hardware: The Complete Revival Guide (2026)

www.fosslinux.com

Liam’s Desktop UX Brief: I have been re­viv­ing old hard­ware with Linux for the bet­ter part of a decade. The ma­chines Windows 11 left be­hind are not trash. They are wait­ing for the right op­er­at­ing sys­tem. In this guide, I walk you through dis­tro se­lec­tion, RAM tun­ing, SSD up­grades, and browser op­ti­miza­tion based on real test­ing, not guess­work.

Why Your Old PC Is Not Dead Yet (2026)

Every year, roughly 62 mil­lion met­ric tons of elec­tronic waste get dumped world­wide. That num­ber keeps climb­ing, and a sur­pris­ing chunk of it is per­fectly func­tional hard­ware that Microsoft sim­ply de­cided not to sup­port any­more. Windows 11 re­quires TPM 2.0, Secure Boot, and rel­a­tively mod­ern CPUs. Machines from 2014 to 2019 that still run per­fectly fine got left out in the cold.

Here is the thing: those ma­chines are not slow be­cause they are old. They are slow be­cause Windows got heav­ier while the hard­ware stayed the same. Linux does not have that prob­lem. A fresh Ubuntu in­stall with Xfce uses roughly 650MB of RAM at idle. Windows 11 uses 3 to 4GB be­fore you even open a browser. The math is not com­pli­cated.

Three ma­jor re­leases in 2026 prove that light­weight Linux is not a niche in­ter­est. BunsenLabs Carbon shipped in February on Debian 13, though it dropped i386 sup­port, which mat­ters if you are work­ing with truly an­cient hard­ware. Xubuntu 26.04 LTS ar­rived in April with Xfce 4.20 and three years of sup­port. Linux Lite 8.0 landed in June with cus­tom per­for­mance ker­nels, a built-in gam­ing stack, and a lo­cal AI as­sis­tant. The ecosys­tem is ac­tive, and it wants your old ma­chine.

Assessing Your Hardware Before Choosing a Distro (2026)

Before you down­load any­thing, you need to know what you are work­ing with. I run three com­mands on every old ma­chine I touch. They tell me every­thing I need to know about whether the hard­ware is worth re­viv­ing and which di­rec­tion to go.

fos­slinux@ubuntu:~$ free -h to­tal used free shared buff/​cache avail­able Mem: 3.3Gi 2.1Gi 158Mi 672Ki 1.4Gi 1.2Gi Swap: 3.8Gi 1.5Gi 2.2Gi fos­slinux@ubuntu:~$ lscpu | head -10 Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit CPU(s): 4 Model name: Intel(R) Core(TM) Ultra 9 285 fos­slinux@ubuntu:~$ ls­blk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS sda 8:0 0 100G 0 disk sda2 8:2 0 100G 0 part /

Here is how I in­ter­pret those num­bers. If you have less than 2GB of RAM, you need the light­est dis­tro avail­able. Between 2 and 4GB opens up most light­weight op­tions. Above 4GB, you can run prac­ti­cally any­thing. For CPU ar­chi­tec­ture, 32-bit only means your op­tions are se­verely lim­ited in 2026. Most mod­ern dis­tros have dropped 32-bit sup­port en­tirely. BunsenLabs Carbon is one of the few that still of­fers i386 me­dia, but even that is gone now.

Storage mat­ters more than peo­ple think. If you are still run­ning a me­chan­i­cal hard drive, the sin­gle biggest up­grade you can make is switch­ing to an SSD. I cover that in de­tail later in this guide.

Pro Tip: Before in­stalling any­thing, boot from a live USB and run those three com­mands. Live en­vi­ron­ments give you an hon­est pic­ture of how the hard­ware per­forms with­out com­mit­ting to an in­stall. If the live ses­sion feels slug­gish, the in­stalled ver­sion will not mag­i­cally be faster.

Choosing the Right Lightweight Distro (2026)

I have tested dozens of light­weight dis­tros over the years. The ones that sur­vive are the ones that bal­ance re­source us­age with ac­tual us­abil­ity. Here is my tier sys­tem based on real-world test­ing.

Tier 1: Under 2GB RAM

When you are work­ing with less than 2GB, every megabyte counts. These dis­tros are de­signed for ex­actly that sce­nario.

an­tiX is my top pick for truly con­strained hard­ware. It runs on sys­temd-free Debian Stable, uses around 256MB at idle, and in­cludes a full desk­top ex­pe­ri­ence. The trade-off is a less pol­ished in­ter­face com­pared to Ubuntu-based op­tions. If you need some­thing even lighter, Puppy Linux runs en­tirely in RAM and can res­ur­rect ma­chines that most dis­tros would re­ject. The learn­ing curve is steeper, but the per­for­mance is un­matched.

BunsenLabs Carbon de­serves a men­tion here. It uses Openbox, an ul­tra-light win­dow man­ager, and sits on Debian 13. The desk­top is min­i­mal­ist but highly con­fig­urable. The catch: BunsenLabs dropped i386 sup­port with Carbon, so truly old 32-bit ma­chines can­not run it any­more.

Also Read

Tier 2: 2 to 4GB RAM

This is the sweet spot for most re­vival pro­jects. You have enough head­room for a proper desk­top en­vi­ron­ment with­out wor­ry­ing about every back­ground process.

Lubuntu 26.04 LTS uses LXQt and con­sumes around 480MB at idle. It is the light­est Ubuntu-based op­tion with full LTS sup­port un­til 2029. If you want some­thing with more pol­ish, Linux Lite 8.0 ships XFCE with cus­tom per­for­mance ker­nels, a built-in gam­ing stack, and util­i­ties like Lite Software and Lite Kernel Manager. It uses about 650MB at idle, which is more than Lubuntu, but the ex­tra tools make it a bet­ter out-of-the-box ex­pe­ri­ence for most peo­ple.

I tested both on a 2014 ThinkPad T440s. Lubuntu felt faster on raw boot time and idle mem­ory. Linux Lite felt snap­pier dur­ing ac­tive use be­cause of the BORE sched­uler, which pri­or­i­tizes in­ter­ac­tive re­spon­sive­ness over idle ef­fi­ciency. For a daily dri­ver, I pre­fer Linux Lite. For a ma­chine with 2GB or less, Lubuntu is the prac­ti­cal choice.

For a de­tailed head-to-head com­par­i­son, check out my Linux Lite vs Lubuntu (2026) com­par­i­son.

Tier 3: 4 to 8GB RAM

With 4GB or more, you can run any light­weight dis­tro com­fort­ably. Xubuntu 26.04 LTS gives you Xfce 4.20 with Ubuntu’s full pack­age ecosys­tem. Linux Mint Xfce adds a more Windows-like in­ter­face with its Cinnamon-inspired lay­out. Both are ex­cel­lent choices, and the de­ci­sion comes down to per­sonal pref­er­ence rather than hard­ware con­straints.

For a full break­down of light­weight op­tions, I main­tain a reg­u­larly up­dated list in my 10 Best Lightweight Distros 2026 guide.

Desktop Environment Showdown: LXQt vs Xfce vs MATE (2026)

The desk­top en­vi­ron­ment is what you ac­tu­ally in­ter­act with every day. It mat­ters more than the un­der­ly­ing dis­tro for daily com­fort. I have spent hun­dreds of hours with all three of these, and here is my hon­est take.

I pre­fer Xfce be­cause of the cus­tomiza­tion depth. When I want to tweak panel po­si­tions, add wid­gets, or change win­dow be­hav­ior, Xfce gives me more op­tions with­out edit­ing con­fig files. LXQt is faster to con­fig­ure if you just want a sim­ple taskbar, but it hits a ceil­ing when you start push­ing for a per­son­al­ized setup. MATE sits in the mid­dle: more pol­ished than LXQt, less con­fig­urable than Xfce.

The per­for­mance gap be­tween LXQt and Xfce is real but smaller than it used to be. On my test ma­chine, LXQt used about 50 to 80MB less RAM at idle. For ma­chines with 2GB of RAM, that dif­fer­ence mat­ters. For ma­chines with 4GB or more, it is neg­li­gi­ble. Pick the one that feels right when you test it from a live USB.

Insight: zram com­presses mem­ory con­tents in RAM in­stead of writ­ing them to disk. On old hard dri­ves, this elim­i­nates the mas­sive per­for­mance penalty of swap hit­ting a me­chan­i­cal plat­ter. A ma­chine with 4GB RAM and zram con­fig­ured can feel like it has 6 to 8GB be­cause com­pressed mem­ory is still faster than disk-based swap.

RAM Optimization: zram, Swappiness, and Service Trimming (2026)

Once you pick a dis­tro, the next step is squeez­ing every drop of per­for­mance out of your hard­ware. These three tech­niques work on any Linux dis­tri­b­u­tion and make a mea­sur­able dif­fer­ence on old ma­chines.

Also Read

Setting Up zram

zram cre­ates a com­pressed swap de­vice in your RAM. Instead of writ­ing mem­ory con­tents to a slow hard drive, Linux com­presses them and keeps them in mem­ory. The trade-off is a small CPU cost for com­pres­sion, but on any ma­chine made in the last 15 years, that cost is neg­li­gi­ble com­pared to the disk I/O sav­ings.

fos­slinux@ubuntu:~$ echo fosslinux’ | sudo -S apt-get up­date [sudo] pass­word for fos­slinux: Hit:1 http://​archive.ubuntu.com/​ubuntu no­ble InRelease … fos­slinux@ubuntu:~$ echo fosslinux’ | sudo -S apt-get in­stall -y zram-tools Reading pack­age lists… Done Building de­pen­dency tree… Done zram-tools is al­ready the newest ver­sion (0.99.1 – 4build3).

After in­stal­la­tion, the con­fig­u­ra­tion lives at /etc/default/zramswap. The de­fault set­tings work well for most ma­chines, but you can tune the al­go­rithm and size if needed. On Ubuntu, zram-tools uses lzo-rle com­pres­sion by de­fault, which of­fers the best bal­ance of speed and com­pres­sion ra­tio.

Tuning Swappiness

Swappiness con­trols how ag­gres­sively Linux moves mem­ory con­tents to swap. The de­fault value of 60 works fine for most ma­chines, but old hard dri­ves ben­e­fit from low­er­ing it. When swap lives on a me­chan­i­cal disk, every swap op­er­a­tion takes mil­lisec­onds in­stead of nanosec­onds.

fos­slinux@ubuntu:~$ cat /proc/sys/vm/swappiness 60 fos­slinux@ubuntu:~$ echo fosslinux’ | sudo -S sysctl vm.swap­pi­ness=10 vm.swap­pi­ness = 10 fos­slinux@ubuntu:~$ echo vm.swappiness=10” | sudo -S tee -a /etc/sysctl.conf vm.swap­pi­ness=10

For ma­chines with SSDs, I leave swap­pi­ness at 60. The SSD is fast enough that swap op­er­a­tions do not cre­ate a no­tice­able penalty. For old hard dri­ves, 10 to 20 is the sweet spot. You still get swap when you need it, but the sys­tem fights harder to keep every­thing in RAM.

Disabling Unnecessary Services

Every run­ning ser­vice con­sumes mem­ory and CPU cy­cles. On a fresh Ubuntu in­stall, sev­eral ser­vices run by de­fault that you may not need.

fos­slinux@ubuntu:~$ sys­tem­ctl is-en­abled blue­tooth en­abled fos­slinux@ubuntu:~$ sys­tem­ctl is-en­abled cups en­abled fos­slinux@ubuntu:~$ sys­tem­ctl is-en­abled avahi-dae­mon en­abled

If you do not use Bluetooth, dis­able it. If you do not have a printer, CUPS is wast­ing re­sources. If you do not need mDNS ser­vice dis­cov­ery, Avahi can go. Each one you dis­able frees up a small amount of mem­ory, and on con­strained hard­ware, those small amounts add up.

fos­slinux@ubuntu:~$ echo fosslinux’ | sudo -S sys­tem­ctl dis­able blue­tooth Synchronizing state of blue­tooth.ser­vice with SysV ser­vice script… … fos­slinux@ubuntu:~$ echo fosslinux’ | sudo -S sys­tem­ctl dis­able cups Synchronizing state of cups.ser­vice with SysV ser­vice script…

I cover more Ubuntu-specific tun­ing in my How to Speed Up Ubuntu 24.04 LTS guide. For a deeper dive into swap­pi­ness me­chan­ics, Brandon Jones wrote an ex­cel­lent ex­plainer on swap­pi­ness in Linux.

Why It Matters: Extending an old PCs life by two to three years with Linux keeps it out of a land­fill. That sin­gle ma­chine rep­re­sents roughly 30 to 50 kilo­grams of elec­tronic waste, in­clud­ing plas­tics, met­als, and rare earth el­e­ments that re­quire enor­mous en­ergy to ex­tract. Reviving hard­ware is the most di­rect form of en­vi­ron­men­tal ac­tion most peo­ple can take.

The SSD Upgrade: Is It Worth It on Old Hardware? (2026)

If your old ma­chine still runs a me­chan­i­cal hard drive, an SSD up­grade is the sin­gle most im­pact­ful change you can make. I have timed boot se­quences on the same hard­ware with HDD and SSD, and the dif­fer­ence is dra­matic.

A typ­i­cal old lap­top with a me­chan­i­cal drive boots Ubuntu in 45 to 60 sec­onds. The same ma­chine with a SATA SSD boots in 12 to 18 sec­onds. Application launch times drop from 5 to 8 sec­onds down to un­der 2 sec­onds. The en­tire sys­tem feels like a dif­fer­ent ma­chine, and the up­grade usu­ally costs less than 30 dol­lars for a 256GB SATA drive.

The process is straight­for­ward. Clone your ex­ist­ing drive with dd or Clonezilla, swap the phys­i­cal drive, and you are done. After the clone, make sure TRIM is en­abled so the SSD main­tains its per­for­mance over time.

Also Read

fos­slinux@ubuntu:~$ sys­tem­ctl is-en­abled fstrim.timer en­abled fos­slinux@ubuntu:~$ echo fosslinux’ | sudo -S fstrim -av /boot/efi: 512 MiB (534773760 bytes) trimmed on /dev/sda1 /: 67.4 GiB (72393039872 bytes) trimmed on /dev/sda2

The fstrim.timer runs weekly by de­fault on Ubuntu, which is suf­fi­cient for most users. If you want man­ual con­trol, you can run sudo fstrim -av when­ever you like. For a com­pre­hen­sive guide on TRIM and SSD op­ti­miza­tion, check out Arjun’s fstrim guide.

When is the SSD up­grade NOT worth it? If the ma­chine has a fail­ing SATA con­troller, if the RAM is less than 2GB and can­not be up­graded, or if the CPU is 32-bit only with no 64-bit sup­port. In those cases, the hard­ware has hit its nat­ural limit, and a soft­ware-only ap­proach is more prac­ti­cal.

Browser Optimization for Constrained Hardware (2026)

The browser is the hun­gri­est ap­pli­ca­tion on most Linux desk­tops. Firefox with ten tabs open can eas­ily con­sume 2 to 3GB of RAM. On a ma­chine with 4GB to­tal, that leaves al­most noth­ing for the op­er­at­ing sys­tem. A few con­fig­u­ra­tion changes make a mean­ing­ful dif­fer­ence.

Open Firefox and type about:con­fig in the ad­dress bar. Accept the risk warn­ing, then search for and mod­ify these set­tings:

browser.cache.disk.en­able: Set to false. This dis­ables the disk cache, which is un­nec­es­sary if you have an SSD (RAM cache is fast enough) and ac­tively harm­ful on old hard dri­ves (constant small writes de­grade per­for­mance).

browser.ses­sion­his­tory.max_en­tries: Reduce from 50 to 15. This lim­its the num­ber of pages Firefox re­mem­bers in each tab’s his­tory, re­duc­ing mem­ory con­sump­tion with­out af­fect­ing nor­mal brows­ing.

browser.ses­sion­store.in­ter­val: Increase from 15000 to 60000. This re­duces how of­ten Firefox saves ses­sion data, cut­ting disk writes on old hard dri­ves.

Beyond Firefox con­fig­u­ra­tion, in­stall uBlock Origin. It is not op­tional on old hard­ware. Ad-heavy web­sites con­sume sig­nif­i­cant CPU and mem­ory for track­ing scripts you never asked for. uBlock Origin blocks those scripts be­fore they load, which can re­duce page mem­ory us­age by 30 to 50 per­cent on ad-heavy sites.

If Firefox still feels heavy, con­sider Falkon or Pale Moon. Both are lighter than Firefox but lack the ex­ten­sion ecosys­tem. For a full com­par­i­son of light­weight browsers, see my light­weight browsers guide.

Worth Knowing: BunsenLabs Carbon dropped i386 sup­port in its February 2026 re­lease. If you are re­viv­ing a truly old 32-bit ma­chine, you will need to use an older BunsenLabs re­lease (Beryllium or ear­lier) or switch to a dis­tro that still sup­ports 32-bit, like Debian 12 with non-free firmware.

Repurposing as a Home Server (2026)

Sometimes the best use for old hard­ware is not as a desk­top at all. If the ma­chine is too slow for daily desk­top use but still func­tional, turn­ing it into a home server gives it a sec­ond life with min­i­mal re­source de­mands.

Also Read

A file server run­ning Ubuntu Server or Debian Minimal can serve your home net­work with less than 512MB of RAM. A Pi-hole DNS server needs even less. A me­dia server run­ning Jellyfin can stream to your other de­vices with­out break­ing a sweat on mod­est hard­ware. The key in­sight is that server work­loads are typ­i­cally bursty: the ma­chine sits idle most of the time and only works hard when some­one re­quests some­thing.

If you want to go this route, I rec­om­mend Ubuntu Server 26.04 LTS or Debian 12 Minimal. Both are light­weight, sta­ble, and sup­ported for years. For a break­down of the best server dis­tros for home use, check out John’s Top 5 Linux Server Distros guide.

The tran­si­tion from desk­top to server also teaches you Linux ad­min­is­tra­tion skills that are valu­able in pro­fes­sional en­vi­ron­ments. You learn net­work­ing, ser­vice man­age­ment, se­cu­rity hard­en­ing, and au­toma­tion. Old hard­ware be­comes a prac­tice lab.

When to Give Up: The Honest Failure Criteria

Not every old ma­chine is worth re­viv­ing. I have learned this the hard way, and know­ing when to stop saves you time and frus­tra­tion.

The hard floor: If the ma­chine is 32-bit only with less than 1GB of RAM, you are look­ing at a very nar­row set of op­tions. Puppy Linux and a few Debian de­riv­a­tives can run, but the ex­pe­ri­ence will be painful for any­thing be­yond ba­sic text edit­ing. At that point, the hard­ware has reached its nat­ural limit.

Failing hard­ware in­di­ca­tors: Run a SMART check on the hard drive with sudo smartctl -a /dev/sda. If you see re­al­lo­cated sec­tors, pend­ing sec­tors, or un­cor­rectable er­rors, the drive is dy­ing. Replace it or re­cy­cle the ma­chine. RAM er­rors are an­other red flag. If memtest86+ throws er­rors, the mem­ory mod­ules are fail­ing and no soft­ware fix will help.

Thermal prob­lems: Old lap­tops with clogged fans and dried ther­mal paste will throt­tle con­stantly. If the CPU hits 90 de­grees Celsius un­der light load, the ma­chine needs phys­i­cal main­te­nance be­fore any soft­ware op­ti­miza­tion will help. Clean the fans, re­place the ther­mal paste, and try again. If that does not help, the cool­ing sys­tem may be phys­i­cally dam­aged.

The hon­est as­sess­ment: If the ma­chine can­not run a light­weight Linux desk­top at a us­able speed af­ter you have ap­plied the op­ti­miza­tions in this guide, it is time to re­cy­cle it re­spon­si­bly. Most mu­nic­i­pal­i­ties have e-waste col­lec­tion pro­grams. Do not throw it in the trash. The com­po­nents con­tain re­cy­clable met­als and toxic ma­te­ri­als that need proper han­dling.

Conclusion

Reviving old hard­ware with Linux is not just pos­si­ble. It is prac­ti­cal, sus­tain­able, and of­ten re­sults in a ma­chine that feels faster than it did when it was new. The key is match­ing the dis­tro to your hard­ware tier, op­ti­miz­ing RAM us­age with zram and ser­vice trim­ming, and be­ing hon­est about when hard­ware has reached its limit.

If you have 4GB or more RAM, Linux Lite 8.0 or Xubuntu 26.04 will give you a pol­ished daily dri­ver ex­pe­ri­ence. Between 2 and 4GB, Lubuntu 26.04 LTS is the prac­ti­cal choice. Under 2GB, an­tiX or BunsenLabs are your best bets, as­sum­ing the hard­ware is 64-bit. An SSD up­grade trans­forms any old ma­chine, and browser op­ti­miza­tion pre­vents Firefox from eat­ing all your avail­able mem­ory.

Also Read

The e-waste cri­sis is real, and every ma­chine we keep run­ning is one less piece of hard­ware in a land­fill. Your old PC is not dead. It just needs the right op­er­at­ing sys­tem.

To add this web app to your iOS home screen tap the share button and select "Add to the Home Screen".

10HN is also available as an iOS App

If you visit 10HN only rarely, check out the the best articles from the past week.

Visit pancik.com for more.