Russia's MinTsifry Proposes Hosting Providers Detect and Report Disguised VPN Services
The Russian Ministry of Digital Development (MinTsifry) is discussing measures to strengthen oversight of VPN services that mask themselves as legitimate websites and hide their IP addresses from official blocklists.
Hosting providers would be required to independently identify suspicious IP addresses and report them to regulators for potential blocking. Currently, addresses of legitimate services are added to a special list to avoid accidental blocking, but the same mechanism is exploited by VPN applications designed to circumvent network restrictions.
The proposal also introduces a tiered trust system for hosting clients based on the strength of their identity verification. Users authenticated only via phone or bank card could have services terminated within 30 minutes upon violations, while those verified through Gosuslugi, the Unified Biometric System, or a full contract would receive more time to resolve issues.
Non-compliant hosting providers risk being labeled as unreliable, resulting in restrictions that limit client access to a narrow whitelist of approved resources such as government portals, banks, and marketplaces.
Industry participants warn that these restrictions could worsen IPv4 address shortages and drive legitimate businesses toward foreign hosting providers, according to RBC.
Related articles
Why Sending an MDM Command Does Not Mean It Has Been Executed
MDM operations such as policy assignment and device lock appear synchronous in the console but actually trigger complex asynchronous delivery chains involving backends, queues, vendor infrastructure, and device agents. The article explains that request acceptance, queue storage, external API confirmation, and actual device execution represent four distinct states that must be tracked separately. Aitera MDM implements an Outbox pattern to ensure transactional consistency between policy changes and command delivery while supporting at-least-once semantics with idempotency. Android Enterprise relies on the Android Management API and Google-controlled synchronization through Android Device Policy, whereas iOS uses APNs only for wake-up and pull-based command retrieval with statuses including Acknowledged, Error, and NotNow. The system maintains separate desired, delivery, and observed states to avoid misleading applied flags and provides detailed command history for administrators. Metrics focus on policy confirmation rates, queue age, and divergence between intended and actual device configurations rather than simple device counts.
Russia's FAS Opens Antitrust Case Against Apple for Failing to Pre-Install Domestic Software on iOS Devices
Russia's Federal Antimonopoly Service has initiated proceedings against Apple after the company failed to comply with a prior warning to pre-install Russian software on iPhones and iPads. The case stems from requirements under Russian law to offer domestic alternatives for search engines, messengers, and app stores. Apple had added support for a Russian search engine in a software update, but this did not satisfy regulators who also demanded the national messenger and domestic app store. Non-compliance could result in a fine reaching up to 4 billion rubles under the Code of Administrative Offenses. The government has already approved a mandatory list of Russian applications that must be pre-installed on smartphones and tablets starting January 1, 2027. The list includes RuStore, Max, Yandex Browser, Alice AI, VKontakte, Gosuslugi, Mir Pay, Mail.ru, and 2GIS among others.
Russia Drafts Rules Letting Users Choose AI Assistant at Smartphone First Boot
The Russian Ministry of Digital Development has published a draft government resolution that would replace the existing voice assistant pre-installation requirement with a broader category called system assistant. The new rules would allow users to select a domestic, foreign, or no AI assistant when first powering on a smartphone. The system assistant is defined as an AI program capable of controlling the device, operating system, and applications through voice, text, and visual commands. Manufacturers would be required to give the chosen assistant equal treatment regarding updates, settings, and interface visibility, and the pre-installed version must remain free and persist after factory resets. Search services could also incorporate AI technologies under the updated list. The ministry states the changes aim to increase competition between Russian and foreign platforms while preserving user access to modern AI services even if certain foreign products face restrictions.
Password Rotation Policies Under Scrutiny: NIST Guidelines, Historical Origins, and Logical Flaws
The article examines the long-standing practice of mandatory password rotation every 90 days, contrasting it with modern recommendations from NIST that advocate changing passwords only upon confirmed compromise rather than on a fixed schedule. It dissects common arguments in favor of periodic rotation, such as limiting offline hash cracking time and terminating unknown sessions, and demonstrates how these rely on reverse logic that starts from the control rather than from actual threats. Historical analysis traces the 90-day rule back to the 1985 DoD Green Book (CSC-STD-002-85), revealing that its own calculations showed password lifetime has minimal impact on security when proper rate limiting is in place. The piece distinguishes between data leakage and credential compromise, emphasizing that internal organizational signals provide far better indicators for targeted password changes than public breach databases. It concludes that scheduled rotation only makes sense as a substitute for mature detection capabilities, a trade-off explicitly recognized in PCI DSS v4.0.