Durev VPN Accused of Plagiarizing Independent Researchers' Articles for Commercial YouTube Promotion
Independent researcher zarazaexe has accused the commercial VPN service Durev VPN of repurposing multiple technical articles for YouTube advertising without attribution or permission.
The original publications covered reverse engineering of the MAX messenger, analysis of Russian TSPU whitelist mechanisms, examination of MinTsifry root certificates, and a detailed review of the Teleга client. Durev VPN converted these texts into video scripts, changed first-person statements to references to their own specialists, and removed any mention of the source author or project name.
One video titled СРОЧНО УДАЛИ СЕРТИФИКАТ МИНЦИФРЫ accumulated 795,000 views within two days. The service's Telegram bot lists 260,000 users, and the cheapest subscription costs 313 rubles per month. Rough calculations suggest that even modest conversion rates could generate several million rubles in recurring revenue from the viewed content.
Direct textual overlaps include the claim that specialists scanned 46 million Russian IP addresses and found 63,000 entries in permitted whitelists, identical descriptions of default-deny and fail-closed architectures, and matching explanations of ECH behavior under DPI inspection. The video also repeated an earlier factual error from the source article regarding total UDP blocking inside whitelists.
Additional videos reused findings from the MAX messenger analysis, including the behavior of class com.my.tracker.core.o.f, MediaDrm Widevine UUID handling in TEE, and the network_security_config.xml flag that permits cleartext traffic. Some material was also drawn from articles published by runetfreedom.
When contacted, the Durev VPN representative demanded proof of patents, suggested the research was generated by Claude, and later invoked fair use while refusing to add attribution. After receiving a DMCA warning, the representative stated the issue would be reviewed by their lawyer within one week. The researcher published the complete conversation and noted that the disputed segment referencing the 46-million-address scan was later edited out of the published video.
The service itself is registered in Kazakhstan. Its client uses the Happ application on non-Android platforms and offers test access for 17 rubles. Measured performance on the test profile showed 494 ms latency with 20 Mbit/s download and 46 Mbit/s upload speeds.
Related articles
How to Avoid Becoming the Hero of 'My Program Deleted 800 GB': Safe Recursive Deletion in Bash and Python
A recent Habr article examines dangerous patterns in recursive file deletion scripts that have caused massive data loss incidents, including an 800 GB wipe triggered by Telegram Desktop on Windows. The piece analyzes classic mistakes such as empty variables in rm commands and extra spaces that turned single paths into multiple destructive arguments, referencing the 2015 Steam Linux bug and the 2011 Bumblebee installer error. It provides hardened Bash templates using set -euo pipefail, ${VAR:?} checks, realpath validation, and --one-file-system flags to prevent deletion of forbidden directories or symlinked targets. The Python section introduces a safe_rmtree wrapper that enforces root boundaries, rejects symlinks, uses resolve(strict=True), and checks shutil.rmtree.avoids_symlink_attacks before proceeding. Additional recommendations include dry-run modes, marker files, temporary directory usage, and logging to make deletion operations auditable and reversible where possible.
Hackers tamper with refrigeration units in European supermarkets, setting temperatures to +50 °C
Attackers gained unauthorized access to refrigeration and freezer control systems in supermarkets across several European countries, including Sweden, Belgium, Luxembourg, and Estonia. In multiple locations they altered temperature settings to +50 °C, risking widespread spoilage of perishable goods. The incidents primarily affected older, unpatched Danfoss controllers that had been connected to networks for remote maintenance. Estonian manufacturer Kitman Coldtech reported that one attack on a legacy Danfoss system was detected and stopped within approximately ten minutes, preventing any damage. Similar intrusions were confirmed by Swedish chains ICA and Coop, following earlier incidents in French supermarkets in October that resulted in product losses. Experts note that legacy industrial controllers remain attractive targets because they are often left exposed once placed online for convenience.
AmneziaWG Container for MikroTik Routers Delivers Top Performance Six Months After Launch
A developer released an AmneziaWG container for MikroTik devices in February 2026 and has since added major improvements in speed, protocol support, and stability. The lightweight container leverages the router's native WireGuard implementation for cryptography while handling AmneziaWG obfuscation in software. Performance now reaches 250-350 Mbit/s on models such as Hap Ax3 and RB5009B after switching to C code and increasing buffer sizes with RouterOS 7.24. New features include server mode for connecting multiple MikroTik devices, random port hopping, IPv6 support, dynamic DNS, and offline configuration. The project survived an early GitHub ban caused by test scripts and has grown to over 370 stars while remaining fully offline and privacy-focused.
Building Resilient DoH Failover on MikroTik RouterOS to Handle Unreachable Cloudflare Responses
A network administrator encountered a persistent issue in a branch office where pages like Tailwind CSS CDN failed to load despite valid DNS responses from Cloudflare DoH. The problem stemmed from unreachable IP addresses such as 8.6.112.0 and 8.47.69.0 returned by the resolver, which RouterOS treated as healthy because it only checked for valid IP types rather than route reachability. RouterOS supports only a single active DoH upstream via the use-doh-server parameter, requiring custom scripting for failover between multiple endpoints like Cloudflare and dns.google. The solution involved static DNS entries for bootstrap addresses, certificate trust anchors including SSL.com TLS ECC Root CA 2022, and a health monitor script that probes using DNS-JSON API calls instead of switching the resolver directly. Multiple iterations addressed issues like cache-based false positives, plain DNS fallback risks from provider spoofing, and clock validation to prevent certificate failures. The final implementation uses thresholds for failure and recovery to avoid flapping and ensures post-switch verification before committing to a backup endpoint.