Watch the video, transcript and sources
+ Tangled: issues, pull requests and comments live on your own server as Git objects (its own announcement)
- France: gigabyte tax amendment adopted 11 to 10, first reading, not law
- ChatGPT: shared link ran code in your session (Parameter's account, fixed Oct 26)
- Scribd: breach notice, no account countInternet taxes usually count revenue or profit. France's National Assembly just adopted one that counts gigabytes, five and a half euro cents each, by eleven votes to ten. One number in the French text does not quite add up. I will check it at the end. A gigabyte tax charges a company for every gigabyte it sends to people, whatever the company earns. Think of a toll booth on the internet that counts bytes instead of cars, and most of the cars are cat videos.
Here is the rate, from the French text. The sender owes the volume in gigabytes times five and a half cents. A hundred gigabytes comes to five euros fifty. A cap limits the bill to fifteen percent of the sender's French revenue, or two percent of its total revenue. The English is our translation. The committee rejected the same text on October ninth. On Friday, the budget rapporteur warned that big platforms could pass the cost to advertisers. The minister said it would need flow sensors, and that half the tax would land on smaller, notably French, providers. The author, from the Socialist group, answered that the services are free, so there is nothing to pass on. Thirty five members voted. Of the twenty one votes counted, eleven said yes and ten said no. It is still only an amendment in the first reading of the budget bill, so later Assembly votes and the Senate can change or remove it. The text I read sets no start date.
On October twenty third I told you Quad9 is leaving France after a court ruling. This time the target is the traffic itself. If you send a lot of data to French users, watch the Senate, and ask your CDN what it reports per country. Story two. The security firm Parameter published how it took over ChatGPT accounts using nothing but a shared conversation link. It reported the bug to OpenAI on October eighteenth. OpenAI rated it P one, and on October twenty sixth confirmed the fix. Parameter describes the chain. Preview runs HTML in a restricted frame on another address. A graph on the same page loaded a math library that listens for messages in the main page. That listener accepted a message without checking who sent it, and the message could carry HTML. The HTML made a new frame, which ran as chatgpt dot com.
In the automatic version, opening the link was the only click. Parameter says its test code listed the victim's conversations and read a private one. It sent only a small piece to its own server to prove it, and OpenAI paid a five thousand dollar bounty. The Preview sandbox itself held. The hole was the listener in the main page. Parameter advises checking both the sender's address and the exact window, and never accepting raw HTML in a cross window message. It is a good day to grep your own message handlers. Story three, a short one. Scribd, the company behind Slideshare and Everand, has a help center notice about a security incident, last updated October first. It says an unauthorized party got into its systems, then reached other internal systems and user information.
For most accounts, Scribd says, that meant basic account information. For a smaller number, more sensitive information was involved. A notice a user posted on Hacker News on Monday lists the email address and the last four card digits. It also lists the card issuer and expiry date, plus country and payment history. Scribd says there is no evidence of misuse. Notices differ by person. A Romanian outlet, Business 24, reports that notices there also list the titles people read or searched. Scribd has not said how many accounts were affected, and it says notices go out in phases, so no email does not mean you were spared. What to do. Scribd asks you to reset your password on all four sites, so do it, and change it anywhere else you reused it. Be wary of any call or email that knows your card's last four digits, because a scammer may know them too.
Story four. Tangled, a code forge built on the AT Protocol, the open protocol Bluesky runs on, shipped a big release on Friday. It calls itself the first truly federated code forge. You can host your repositories on your own server, which Tangled calls a knot, and still collaborate with people on other knots. The change that matters is where the discussion lives. Issues, pull requests and comments are now stored on the knot, right next to the code, as chains of Git objects. A knot could try to put words in your mouth, so each edit also writes a record to your own personal data server. Tangled calls it two way verification. Until this release, the whole web app was one Go program on a single SQLite database on one server in Sweden. Now it is a Svelte frontend at the edge, plus a read only indexer in Rust that runs in eleven or more regions.
If you self host, the release asks you to upgrade your knots to version one point twenty. Private repositories and a command line tool are listed for the next few weeks. This is Tangled's own announcement, and I found no independent review yet.
Verdict: NEEDS REVIEW — Four stories, four open questions. Read the primary sources.
Sources
https://www.assemblee-nationale.fr/dyn/17/comptes-rendus/seance/session-ordinaire-de-2026-2027/premiere-seance-du-vendredi-30-octobre-2026
https://www.assemblee-nationale.fr/dyn/17/amendements/3210A/AN/1358
https://www.assemblee-nationale.fr/dyn/17/amendements/3210A/CION_FIN/CF365.pdf
https://www.europe1.fr/politique/budget-2027-les-deputes-votent-une-taxe-au-gigaoctet-1197300
https://www.politiquematin.fr/taxe-gigaoctet-assemblee-11-voix-10-gouvernement-budget-2027
https://www.parameter.ai/labs/we-found-a-gap-at-openai
https://news.ycombinator.com/item?id=50314699
https://support.scribd.com/hc/en-us/articles/53787421531284-Information-about-the-recent-security-incident
https://news.ycombinator.com/item?id=50312756
https://business24.ro/incident-de-securitate/scribd-notificare-utilizator-romania-incident-securitate-conturi-1673136
https://tangled.org/blog/forge/
https://news.ycombinator.com/item?id=50305573
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.
YouTube · Newsletter · thedailydiff.dev · forward this to the intern who deployed on Friday.