Cat Tunnels Service Deploys Kotator-Rotator to Counter Mass Blocking of Relay Nodes in Russia
The operators of the decentralized Cat Tunnels service arrived at work expecting a routine day until the director burst in with reports that users across Russia could no longer connect reliably.
Although the service is designed to be decentralized, it still depends on a set of tracker nodes that help new clients locate entry points. At the time of the incident, several dozen such nodes were running in different countries, providers, and data centers. Every single one of them was blocked inside Russia.
The team began manually spinning up replacement servers, only to see each new instance blocked within minutes. This reactive approach proved unsustainable, leading to the development of Kotator-Rotator.
Kotator-Rotator continuously monitors relay availability using statistics collected directly from clients. Nodes that consistently disappear from client views are automatically decommissioned and replaced. The more severe the blocking, the more aggressively the system rotates infrastructure.
The rotation threshold is governed by Grohotator, an aggregated metric calculated from client technical logs. When the value exceeds a defined limit, a loud siren sounds across the office floor. The metric proved essential because server-side checks showed all relays as healthy and reachable from the public internet; only client perspectives revealed the actual connectivity failures.
Review of the logs also uncovered operational patterns on the blocking side. Activity drops sharply on Friday evenings and resumes around 8 a.m. on Monday, suggesting the responsible teams follow standard working hours.
Related articles
Google Chrome Tests Visible Global Privacy Control Toggle in Canary
Google is testing a new visible toggle for Global Privacy Control in Chrome Canary that lets users send a standardized request asking websites not to sell or share their personal data and not to use it for targeted advertising. When enabled, the browser adds the Sec-GPC: 1 header to web requests and exposes the setting via navigator.globalPrivacyControl. In regions with supporting laws such as California's CCPA, the signal can serve as a formal opt-out from data sales. The feature currently appears primarily on Android, with experimental flags available on Windows, macOS, Linux, and ChromeOS, though the desktop interface remains incomplete. Two separate flags are required—one to show the toggle and another to actually transmit the signal—because enabling only the UI does not send Sec-GPC: 1. The mechanism is not a guaranteed enforcement tool; websites decide how to respond, and effectiveness depends on legal frameworks and site compliance. The feature is absent from the stable Chrome release and may still change before wider rollout.
OpenAI ChatGPT Computer History Feature on macOS Could Expose Detailed User Activity Logs to Infostealers
OpenAI has introduced the Computer History feature in its macOS ChatGPT app, which records application switches, clicks, keystrokes, and accessibility context to generate AI summaries and memories. The feature is disabled by default and requires explicit activation of Memories, with availability limited to Pro, Business, and Enterprise users outside the EEA, Switzerland, and the UK. While raw event files are deleted after 48 hours and not used for model training, the resulting Markdown memory files remain unencrypted on the local Mac. These files can be read by any process running under the same user account, creating a ready-made activity log for infostealers and other malware. OpenAI also warns about prompt injection risks where hidden instructions from websites or apps could influence ChatGPT or Codex behavior. Users retain controls to select participating apps, pause collection, or delete history, but the lack of encryption on stored memories raises significant privacy concerns.
AirTag and SmartTag: How to Detect If a Bluetooth Tracker Is Following You
Phones can now warn users when an unknown Bluetooth tracker such as an Apple AirTag or Samsung SmartTag is moving alongside them for an extended period. The alerts do not automatically confirm stalking, since the same tags can be left in taxis, rental cars or borrowed bags, yet they should never be ignored. AirTag and SmartTag rely on crowdsourced Bluetooth networks rather than built-in GPS or cellular connections, allowing them to report approximate locations only when nearby phones relay the signal. The article details differences from traditional GPS trackers, explains how to interpret notifications on iOS 17.5+ and Android 6.0+, and provides step-by-step guidance for locating hidden devices in clothing, vehicles or personal items. It also covers immediate safety actions, evidence preservation for police reports, and practical steps to reduce future tracking risks through account and permission hygiene.
VPN Encryption Alone Cannot Hide Traffic from Network Detection Systems
A Habr user known as mr_tom detailed why encrypted VPN connections remain detectable despite their encryption. Observers can identify connections through visible metadata such as server IP addresses, ports, transport protocols, handshake patterns, packet sizes, timing intervals, and overall flow behavior. Simple DPI systems block traffic by restricting known IPs or ports, while advanced filters build traffic fingerprints and use active probing to verify suspicious endpoints. The popular combination of VLESS, XHTTP, and REALITY operates across different layers rather than functioning as three equivalent VPN protocols. Even traffic on port 443 can be distinguished from standard HTTPS by analyzing handshake details and subsequent packet behavior. The core conclusion is that no universally unblockable VPN exists, as detection can rely on IP blocking, new signatures, or active verification regardless of encryption strength.