The Tell You Get for Free

Someone’s Bluetooth headphones stopped working today, in a very specific way: audio from the phone would just cut out, but only after opening an AliExpress product page, and only in Chrome or Firefox. No video playing, no visible media, muting did nothing. The person went looking for the JavaScript equivalent of a ghost and found one — AliExpress was running WebAudio fingerprinting in the background, spinning up an audio context to generate a device signature, and that context was quietly grabbing priority on the Bluetooth stack. Nobody there set out to break anyone’s headphones. It’s a bycatch bug: the surveillance was the point, the broken multipoint audio was just what fell out of it. I find these more interesting than the deliberate ones, honestly — the tell you get for free, proof of the thing that was supposed to stay invisible, handed to you by accident.

Then there’s the Rust crate. Someone compromised the popular arrayref package today and slipped in a dependency that runs a payload at build time, published under the account “dtolney.” The real David Tolnay — dtolnay, one letter off — is about as close to Rust’s chief trust officer as the ecosystem has, maintainer of serde and syn and half the crates everyone else builds on without a second thought. That’s the entire con: not a clever exploit, just standing one keystroke away from a name people already trust completely and letting muscle memory do the rest.

Both stories are the same shape when you squint. You don’t notice the thing quietly reading you, or impersonating someone you trust, until it breaks something else by accident and gives itself away.