Microsoft Will Finally Kill Obsolete Cipher That Has Wrecked Decades of Havoc

An anonymous reader quotes a report from Ars Technica: Microsoft is killing off an obsolete and vulnerable encryption cipher that Windows has supported by default for 26 years following more than a decade of devastating hacks that exploited it and recently faced blistering criticism from a prominent US senator. When the software maker rolled out Active Directory in 2000, it made RC4 a sole means of securing the Windows component, which administrators use to configure and provision fellow administrator and user accounts inside large organizations. RC4, short for Rivist Cipher 4, is a nod to mathematician and cryptographer Ron Rivest of RSA Security, who developed the stream cipher in 1987. Within days of the trade-secret-protected algorithm being leaked in 1994, a researcher demonstrated a cryptographic attack that significantly weakened the security it had been believed to provide. Despite the known susceptibility, RC4 remained a staple in encryption protocols, including SSL and its successor TLS, until about a decade ago. […]

Last week, Microsoft said it was finally deprecating RC4 and cited its susceptibility to Kerberoasting, the form of attack, known since 2014, that was the root cause of the initial intrusion into Ascension’s network. “By mid-2026, we will be updating domain controller defaults for the Kerberos Key Distribution Center (KDC) on Windows Server 2008 and later to only allow AES-SHA1 encryption,” Matthew Palko, a Microsoft principal program manager, wrote. “RC4 will be disabled by default and only used if a domain administrator explicitly configures an account or the KDC to use it.” […] Following next year’s change, RC4 authentication will no longer function unless administrators perform the extra work to allow it. In the meantime, Palko said, it’s crucial that admins identify any systems inside their networks that rely on the cipher. Despite the known vulnerabilities, RC4 remains the sole means of some third-party legacy systems for authenticating to Windows networks. These systems can often go overlooked in networks even though they are required for crucial functions.

To streamline the identification of such systems, Microsoft is making several tools available. One is an update to KDC logs that will track both requests and responses that systems make using RC4 when performing requests through Kerberos. Kerberos is an industry-wide authentication protocol for verifying the identities of users and services over a non-secure network. It’s the sole means for mutual authentication to Active Directory, which hackers attacking Windows networks widely consider a Holy Grail because of the control they gain once it has been compromised. Microsoft is also introducing new PowerShell scripts to sift through security event logs to more easily pinpoint problematic RC4 usage. Microsoft said it has steadily worked over the past decade to deprecate RC4, but that the task wasn’t easy. “The problem though is that it’s hard to kill off a cryptographic algorithm that is present in every OS that’s shipped for the last 25 years and was the default algorithm for so long, Steve Syfuhs, who runs Microsoft’s Windows Authentication team, wrote on Bluesky. “See,” he continued, “the problem is not that the algorithm exists. The problem is how the algorithm is chosen, and the rules governing that spanned 20 years of code changes.”


Read more of this story at Slashdot.

Google is retiring its free dark web monitoring tool next year

Google will stop sending out dark web reports starting early next year, as it shuts down the free tool that can tell you if your personal information has appeared on the seedy underbelly of the internet. The tool used to be exclusively available to Google One subscribers until the company opened it up to everyone in mid-2024. If you switch it on, you’ll receive a notification whenever your name, email address and phone number leak on the internet, typically due to data breaches.

In Google’s email announcement, however, it said it was discontinuing dark web reports because “feedback showed that it did not provide helpful next steps.” A report just lets you know that your information has appeared on the dark web. You can also see a list of all the hits you get on your Google account, along with what data breach leaked that particular detail. However, it doesn’t give you guidance on what to do afterwards.

The company explained that it will focus on tools that can give you clear, actionable step to take instead. Google will stop monitoring for new dark web results on January 15, 2026 and will remove access to the report from your account on February 16. You can also remove your monitoring profile right now by going to the “results with your info” section on the tool’s official page.

This article originally appeared on Engadget at https://www.engadget.com/cybersecurity/google-is-retiring-its-free-dark-web-monitoring-tool-next-year-023103252.html?src=rss

Lidar-Maker Luminar Files For Bankruptcy

Once a star of the self-driving hype cycle, lidar maker Luminar has filed for bankruptcy amid legal turmoil, layoffs, and a cooling autonomous-vehicle market. It plans to sell off its assets before shutting down entirely. The Verge reports: As part of its bankruptcy, Luminar is seeking permission to sell both its lidar and semiconductor businesses, the latter of which it has already agreed to sell to Quantum Computing for $110 million. The company plans to continue to operate during the bankruptcy proceedings “to minimize disruptions and maintain delivery of its LiDAR hardware and software.” That said, Luminar will cease to exist once the process is complete. “As we navigate this process, our top priority is to continue delivering the same quality, reliability and service our customers have come to expect from us,” CEO Paul Ricci said in a statement.

After launching in 2017, Luminar muscled its way to the front of the autonomous vehicle industry as a top maker of lidar systems, a key technology that driverless cars use to sense the shapes and distances of objects around them. Luminar has sold sensors to Mercedes-Benz, Volvo, Audi, Toyota Research Institute, Caterpillar, and even Tesla, which has dismissed lidar sensors in favor of traditional cameras. The company was valued at nearly $3 billion when it went public through a reverse merger with a SPAC in 2020.


Read more of this story at Slashdot.

LG will debut its first Micro RGB television at CES

LG is getting in on one of the newest trends for televisions with the introduction of Micro RGB. The company will unveil the LG Micro RGB evo at CES 2026, but it shared some preliminary information about the screen today.

Micro RGB is a newer screen technology where rather than white lights, the backlight can be any hue thanks to individually controlled red, green and blue Micro LEDs, offering a wider color array. This approach is a mid-way point between the precision of OLED with its individual pixel lighting, but it offers an upgrade over screens only using mini LEDs.

The television is also equipped with an upgraded engine for AI upscaling. According to the company’s press release, the LG Micro RGB evo is certified by Intertek for 100 percent color gamut coverage in BT.2020, DCI-P3, and Adobe RGB. The TV has more than a thousand dimming zones for brightness control.

The few other brands currently using micro RGB are charging a pretty penny for it; the one announced by Samsung earlier this year costs $29,999. At 115 inches, the Samsung version is also much larger than LG’s offerings, which include options at 100 inches, 86 inches and 75 inches. Although the size is reduced, expect the eventual prices for the LG Micro RGB evo to also be very expensive.

This article originally appeared on Engadget at https://www.engadget.com/home/home-theater/lg-will-debut-its-first-micro-rgb-television-at-ces-010037923.html?src=rss

Stainless Steel Bear Claw Mule Slides

Inspired by bare bear feet, these Bear Claw Mules from Bravest Studios are $115 faux fur mules with real steel claws, perfect for destroying the legs of your favorite furniture. Now I know what you’re wondering — but are they also available in white, grey, black, purple, green, blue, orange, and spotted purple and teal like Sullivan in Monsters, Inc.? AND YES THEY ARE. Buy a pair of each and you can wear a different color bear claw slide nine days a week! That’s when you know you’ve made it. Where exactly you’ve made it, I have no clue, but there you are with your blue bear claw slides on a Mursday.

Google Search Homepage Adds a ‘Plus’ Menu

After introducing an AI Mode shortcut earlier this year, Google has now added a new “plus” menu to its Search homepage, highlighting options for image and file uploads. 9to5Google reports: On google.com, the Search bar now has a plus icon at the far left that replaces the magnifying glass. Clicking lets you “Upload image” or “Upload file.” It very much matches the AI Mode experience. Those two capabilities aren’t new, but this plus menu does help emphasize that you can use Google to accomplish tasks, and not just find information. Additionally, it helps indicate that they can be used with AI Mode and AI Overviews. This is just available on desktop web (not mobile) and is live on all the devices we checked today, including across signed-out Incognito sessions.


Read more of this story at Slashdot.

Judge blocks Louisiana’s social media age verification law

A Louisiana law that would have required social media platforms to verify the ages of their users has been blocked by a judge. The law, known as the Secure Online Child Interaction and Age Limitation, was passed in 2023 and required Meta, Reddit, Snap, YouTube Discord and others to implement age verification and parental control features.

The ruling came just days before the law, which technically took effect over the summer, would have started to be enforced. In his ruling, Judge John W. deGravelles wrote that the law’s “age-verification and parental-consent requirements are both over- and under-inclusive,” and that its definition of “social media platform” was “nebulous.”

The ruling was a victory for NetChoice, a lobbying group that represents the tech industry and has challenged the growing number of age verification laws around the world. The group had argued that the law was unconstitutional and posed a safety and security risk.

In a statement following the ruling, the group pointed to the “massive privacy risk” posed by the Louisiana law and others like it. “Louisiana’s law would have done more than chill speech,” Paul Taske, the co-director of NetChoice’s Litigation Center said. “It would have created a massive privacy risk for Louisianans like those playing out in real time in countries without a First Amendment, like the UK.”

The Louisiana Attorney General’s office didn’t immediately respond to a request for comment.

This article originally appeared on Engadget at https://www.engadget.com/social-media/judge-blocks-louisianas-social-media-age-verification-law-001212758.html?src=rss

China, Iran Are Having a Field Day With React2Shell, Google Warns

A critical React vulnerability (CVE-2025-55182) is being actively exploited at scale by Chinese, Iranian, North Korean, and criminal groups to gain remote code execution, deploy backdoors, and mine crypto. The Register reports: React maintainers disclosed the critical bug on December 3, and exploitation began almost immediately. According to Amazon’s threat intel team, Chinese government crews, including Earth Lamia and Jackpot Panda, started battering the security hole within hours of its disclosure. Palo Alto Networks’ Unit 42 responders have put the victim count at more than 50 organizations across multiple sectors, with attackers from North Korea also abusing the flaw.

Google, in a late Friday report, said at least five other suspected PRC spy groups also exploited React2Shell, along with criminals who deployed XMRig for illicit cryptocurrency mining, and “Iran-nexus actors,” although the report doesn’t provide any additional details about who the Iran-linked groups are and what they are doing after exploitation. “GTIG has also observed numerous discussions regarding CVE-2025-55182 in underground forums, including threads in which threat actors have shared links to scanning tools, proof-of-concept (PoC) code, and their experiences using these tools,” the researchers wrote.


Read more of this story at Slashdot.

LG quietly added an unremovable Microsoft Copilot app to TVs

Microsoft made a big punt this year with Copilot. The company put its AI chatbot into a special line of laptops and has also tried to integrate it into other tech products. The latest place you may find Copilot is on your LG smart television, whether you want it or not.

Several LG smart TV owners have taken to Reddit over the past few days to complain that they suddenly have a Copilot app on the device and cannot uninstall it. Two Engadget staffers discovered the app on a 2022 LG OLED and a 2023 UA8000. They confirmed that the app can’t be removed, although they were able to hide it from the home screen. One other person from our team also has a 2022 LG OLED but isn’t seeing Copilot, so your mileage may vary based on what permissions and privacy settings you already have set up with LG.

Photo of the undeleteable Copilot app on an LG smart TV
Karissa Bell for Engadget

LG said during the 2025 CES season that it would have a Copilot-powered AI Search in its next wave of TV models, but putting in a permanent AI fixture is sure to leave a bad taste in many customers’ mouths, particularly since Copilot hasn’t been particularly popular among people using AI assistants.

This article originally appeared on Engadget at https://www.engadget.com/ai/lg-quietly-added-an-unremovable-microsoft-copilot-app-to-tvs-235923754.html?src=rss

These Two New iPhone Features Are Coming to iOS 26.3

Just three days after Apple released iOS 26.2 to iPhones everywhere, the company is back at it with a new update. iOS 26.3 is official, though only for beta testers. Those brave enough to install Apple’s unfinished software on their devices won’t find an update packed to the brim with new features and changes, but they will stumble upon two key new features. The thing is, we already knew both of them were on the way.

This isn’t the end all be all for the update, however: Since iOS 26.3 is so new, it’s possible testers will discover additional features hidden within the update. In addition, Apple may add new changes in subsequent beta versions. I’ll continue to update this article to reflect any new features that reveal themselves, but, until then, here are the two new features we know about.

Notification forwarding

Back in September, we learned that Apple was quietly working on some type of notification forwarding feature, but other than that basic functionality, the details were left to speculation. At the time, the common assumption was that Apple intended the feature to be used to forward notifications to third-party devices, specifically smartwatches, in an attempt to open up the platform to wearables other than the Apple Watch. This wouldn’t be Apple’s choice, of course—left to its own devices, the company would keep as many features locked to Apple devices as possible. Instead, the motivation would come from the EU, which has compelled Apple to make its platforms more cooperative with third-party devices.

After three months, we are now getting our first official look at this feature. In this first iOS 26.3 beta, there is now a “Notification Forwarding” option in Notification settings. While the option isn’t live at this time, Apple does have a description for how the feature works, saying that notifications can be forwarded to one device at a time. Importantly, the description says that when notifications are forwarded to another device, they will not appear on your Apple Watch. Is that limitation really necessary, Apple?


This Tweet is currently unavailable. It might be loading or has been removed.

Transfer to Android

Knowledge of iOS 26.3’s second feature is not quite so old. In fact, we only learned about it last week. As it happens, Apple is working directly with Google on an official way to make transferring between an iPhone and an Android device more seamless.

As of last week, Google had already rolled out its first test of the feature to Android Canary, but it was nowhere to be found in Apple’s betas. Now, we know what to expect: In iOS’ “Transfer or Reset iPhone” settings, there is now a new “Transfer to Android” option. Here, iOS instructs you to place your iPhone near your Android device, where you can choose to pass along data like photos, messages, notes, and apps. However, it seems not all data will transfer: Health data, devices paired with Bluetooth, and “protected items” like locked notes will not come along with this transfer feature.


This Tweet is currently unavailable. It might be loading or has been removed.

Beware of running betas on your iPhone

This isn’t the flashiest beta Apple has ever shipped, but it is possible to install right now. Both the developer and public betas are now available, which means anyone interested can enroll their device in Apple’s beta program to give 26.3 a try.

However, know the risks before you do. Unfinished software could come with bugs and glitches that could impact your experience using your iPhone. If the software is particularly glitchy, you could lose data when downgrading back to iOS 26.2. If you do decide to install the beta, make a complete backup of your iPhone to a Mac or PC before you do.

JPMorgan Steps Further Into Crypto With Tokenized Money Fund

An anonymous reader quotes a report from the Wall Street Journal: JPMorgan Chase is joining the list of traditional financial firms seeking to bring blockchain technology to an investing staple: the money-market fund. The banking giant’s $4 trillion asset-management arm is rolling out its first tokenized money-market fund on the Ethereum blockchain. JPMorgan will seed the fund with $100 million of its own capital, and then open it to outside investors on Tuesday. Called My OnChain Net Yield Fund, or “MONY,” the private fund is supported by JPMorgan’s tokenization platform, Kinexys Digital Assets, and will be open to qualified investors, or individuals with at least $5 million in investments and institutions with a minimum of $25 million. The fund has a $1 million investment minimum.

Wall Street has waded deeper into tokenization since the passage of the Genius Act earlier this year. The landmark measure, which establishes a regulatory framework for tokenized dollars known as stablecoins, has unleashed a wave of efforts to tokenize everything from stocks and bonds to funds and real assets. “There is a massive amount of interest from clients around tokenization,” said John Donohue, head of global liquidity at J.P. Morgan Asset Management. “And we expect to be a leader in this space and work with clients to make sure that we have a product lineup that allows them to have the choices that we have in traditional money-market funds on blockchain.”


Read more of this story at Slashdot.

This Samsung SmartTag Four-Pack Is 50% Off Right Now

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

While it’s not the best choice for iPhone users or most other Android phones, for those in the Samsung ecosystem with a Galaxy device, the Samsung SmartTag2 Bluetooth tracker is an effective way to find often-misplaced items. Right now, a Samsung SmartTag2 four-pack is half off at $44.99 (originally $99.99) on Woot, making it a great gift to yourself this holiday season or a stocking stuffer for family or friends.

This tracker has UWB + AR precision finding, location history, and “Compass View” direction guidance, as well as a Bluetooth range of around 120 meters. While it’s not as universally compatible with devices as trackers like the Tile Pro, the network is more widespread because of a higher app user-base. The device has a replaceable battery and lasts up to 500 days in Normal Mode, and up to 700 days in Power-Saving Mode, according to PCMag.

An IP67 rating protects it from dust and water, making it splash- and rainproof, while a built-in loop makes it easy to attach to pet collars, bags, keys, and other items. The SmartTag2 also has a “Lost Mode” that lets people who find the device view your info via an NFC scan. 

The main drawback of this tracker is its limited compatibility—it only works with Samsung Galaxy devices and requires both the SmartThings app and a Samsung account. Still, if you’re in the Samsung Galaxy ecosystem, this Samsung SmartTag2 four-pack makes an excellent, easy-to-use pick with dependable tracking, a durable build, and long battery life—especially with the current discount, which brings it down to just over $11 per tag. 

Our Best Editor-Vetted Tech Deals Right Now


Sony WH-1000XM5


—
$248.00

(List Price $399.99)


Amazon Fire TV Stick 4K Plus


—
$29.99

(List Price $49.99)


Meta Quest 3 512GB Mixed Reality VR Headset with Controllers


—


(List Price $407.10 With Code “QUEST30”)

Deals are selected by our commerce team

Merriam-Webster crowns “slop” word of the year as AI content floods Internet

Like most tools, generative AI models can be misused. And when the misuse gets bad enough that a major dictionary notices, you know it’s become a cultural phenomenon.

On Sunday, Merriam-Webster announced that “slop” is its 2025 Word of the Year, reflecting how the term has become shorthand for the flood of low-quality AI-generated content that has spread across social media, search results, and the web at large. The dictionary defines slop as “digital content of low quality that is produced usually in quantity by means of artificial intelligence.”

“It’s such an illustrative word,” Merriam-Webster president Greg Barlow told the Associated Press. “It’s part of a transformative technology, AI, and it’s something that people have found fascinating, annoying, and a little bit ridiculous.”

Read full article

Comments

Merriam-Webster’s 2025 Word of the Year Is ‘Slop’

Merriam-Webster crowned “slop” its 2025 Word of the Year, reflecting growing public awareness and and fatigue around low-quality, AI-generated content flooding the internet. “It’s such an illustrative word,” said Greg Barlow, Merriam-Webster’s president. “It’s part of a transformative technology, AI, and it’s something that people have found fascinating, annoying and a little bit ridiculous.” The Associated Press reports: “Slop” was first used in the 1700s to mean soft mud, but it evolved more generally to mean something of little value. The definition has since expanded to mean “digital content of low quality that is produced usually in quantity by means of artificial intelligence.” In other words, “you know, absurd videos, weird advertising images, cheesy propaganda, fake news that looks real, junky AI-written digital books,” Barlow said. “Words like ‘ubiquitous,’ ‘paradigm,’ ‘albeit,’ ‘irregardless,’ these are always top lookups because they’re words that are on the edge of our lexicon,” Barlow said. “‘Irregardless’ is a word in the dictionary for one reason: It’s used. It’s been used for decades to mean ‘regardless.'”

The announcement can be found here.


Read more of this story at Slashdot.

I Tested Google’s New Live Translation With AirPods, and It Actually Works Well

I can be pretty tough on AI, especially when it’s used to make misinformation slop. But as cynical as I may seem, I do acknowledge that there are plenty of useful and beneficial features that AI powers. Take live translation, for instance: Not long ago, the concept of a device that could translate someone else’s words directly in your ear as they spoke would seem like some far future technology. But not only is it not a futuristic technology, both Google and Apple have their own takes on the feature that users can take advantage of.

That said, not all iPhone and Android users alike have been able to use live translate. Both companies have limited the feature to work with their respective earbuds: For Apple, that’s the AirPods Pro 2 and AirPods Pro 3; for Google, that’s the Pixel Buds. Without your platform’s flagship earbuds, you haven’t been able to use live translation, and instead need to stick with the rest of your translation app’s experience, whether that be Apple Translate or Google Translate. Lucky for Android users, that’s no longer the case for the latter.

On Friday, Google announced new Gemini translation capabilities for its proprietary translation app. The company says these new updates introduce “state-of-the-art text translation quality,” with more nuanced, natural, and accurate translations. Importantly, however, as part of those upgrades, the company is launching a beta where all Google Translate users can access live translation through any headphones—not just Pixel Buds. This initial rollout is only available on the Android version of Google Translate in the U.S., Mexico, and India, though Google says the company will bring the feature to iOS and more regions in the next year.

This is kind of huge: Companies typically like to keep features like this locked behind their own platform as a marketing tactic. You’re more likely to buy Pixel Buds over other earbuds or headphones if you really want to try live translation. However, you don’t even need to buy a new pair of headphones to use this feature at all: As long as you have some type of headphones or earbuds connected to your Android device, you can translate conversations on the fly.

Trying Google’s live translate with Apple headphones

I gave this a shot on my Pixel 8 Pro with my AirPods Max, by playing a video of people speaking Portuguese. Set up wasn’t the simplest: First, it took forever for the Pixel to recognize my AirPods, despite the headphones being in pairing mode for some time, but that’s beside the point. The key issue was getting Google Translate to present the new beta for live translation. When I first opened it, it was using the older live translate feature, which didn’t work with my AirPods. I had the latest version running, so I uninstalled and reinstalled the app. When it launched, I didn’t have live translate at all. Finally, after force quitting and reopening the app, I got a pop-up for the new live translation beta experience.

The next part was user error: I had my language set to the target language (Portuguese), and vice versa. As such, Google assumed I would be the one speaking Portuguese, and didn’t vocalize the English translation. Once I flipped the languages, and confirmed that English would be spoken through my headphones, the feature started working—and well, for that matter. The video I choose was taken from a news broadcast, with two anchors, and various speakers during news segments. Once the video started, I could see Google Translation translating the words on my screen, and, after about four seconds, I heard the audio translated in my hear. Google Translate even tries to match the speaker’s voice, and though it certainly isn’t a deepfake, it does well enough to distinguish different speakers from one another. It even tried to take on more a serious tone to match the anchor’s, versus the more casual tone of one of the people interviewed in a news segment.

I tried a couple of other videos in different languages, but this time, using the “Detect language” feature rather than a preset target language. The app was able to recognize this video was spoken in Thai, and this one was spoken in Urdu, and translated both accordingly. And while I can’t verify the quality of the translation (I am sadly not fluent in any other language), the experience was overall easy enough to follow. The speed of speech can get a bit slow at times, perhaps because the AI has a lot to process at once, but as long as you turn up the volume on your headphones, it’s easy enough to follow.

All that to say, I’m very interested to give this a try in a real world scenario. Even though my daily driver is an iPhone, I might need to start carrying around my Pixel 8 Pro just in case.

Ford is rebooting the F-150 Lightning as an EREV with a gas generator

Just last month, Ford seemed to be on the brink of sunsetting the F-150 Lightning. Today, the vehicle manufacturer announced plans to reboot the truck as a hybrid. This next generation of the F-150 Lightning will contain Extended Range Electric Vehicle. An EREV is similar in concept to a plug-in hybrid but with a larger battery that’s topped up by a gas generator — the powertrain itself is all electric. This next generation of the F-150 Lightning will offer an estimated range of more than 700 miles. Production will end this year on the current F-150 Lightning models.

This revamp of the F-150 Lightning is part of Ford’s latest approach to electric vehicles. The company projected that by 2030, half of its global volume will be comprised of hybrids, extended-range EVs and electric vehicles, compared with 17 percent today. “As part of these actions, Ford no longer plans to produce select larger electric vehicles where the business case has eroded due to lower-than-expected demand, high costs and regulatory changes,” the company’s press release states. Ford will also swap its planned electric commercial van for North America with a new, affordable commercial van that has both gas and hybrid options. The company anticipates seeing a $19.5 billion negative impact for this pivot away from EVs.

This article originally appeared on Engadget at https://www.engadget.com/transportation/evs/ford-is-rebooting-the-f-150-lightning-as-an-erev-with-a-gas-generator-222529768.html?src=rss

Stranger Things S5 trailer teases Vol. 2

We’re 10 days away from the next installment of the fifth and final season of Stranger Things, and Netflix has released a new trailer for what it’s calling Volume 2. This will cover episodes five through seven, with the final episode comprising Vol. 3.

(Spoilers for Season 5, Vol. 1 below.)

Season 4 ended with Vecna—the Big Bad behind it all—opening the gate that allowed the Upside Down to leak into Hawkins. We got a time jump for S5, Vol. 1, but in a way, we came full circle, since those events coincided with the third anniversary of Will’s original disappearance in S1.

Read full article

Comments

What’s Good (and What’s Overhyped) About the Viral 2-2-2 Workout

If I’ve learned anything about online fitness content in the years I’ve spent consuming and creating it, it’s this: Stack a bunch of numbers together, and you have a potentially viral workout, from 12-3-30 to 4-2-1.

The latest is the 2-2-2 workout, which is supposed to reveal the big secret of effectively building muscle after you hit age 40. Unfortunately, after trying it out, I’m not so sure about that.

What the Internet says about the 2-2-2 workout

I’ve been seeing the 2-2-2 workout pop up across the Internet, but all the sources point back to a video from Alain Gonzalez that claims the “2-workout-2-set” method is “getting men over 40 jacked FAST.” 

That’s pretty much the whole pitch: The number 2 comes up twice (I felt like I was going mad trying to find out what the last 2 is for), and it’s aimed at middle-aged men. I’m not a man, but as a middle-aged woman with personal training and weightlifting coaching certifications, I’m in a pretty good positions to evaluate those claims. So let’s take a look at what’s actually in the workouts. 

What 2-2-2 stands for

I looked at the PDF Gonzalez offers that describes the program, and in it he does actually say what the many articles about his method did not: what the third “2” stands for. So, the 2-2-2 method is: 

  • Two full-body workouts per week

  • Two working sets per exercise

  • Two reps in reserve on each set

It’s a fine setup, I think, and probably a lot of people of any gender or age would get stronger using a workout like this. But it also relies on two often misunderstood concepts. 

What are “working sets”? 

A working set is a set of an exercise that you think of as your “real” work for the day. This means that it does not include warmup sets, or anything else you do to prepare for those working sets. 

This means you might end up doing more than two sets, depending on the exercise. For example, I may not need any warmup sets to do my cable lateral raises (one of the exercises Gonzalez recommends), so that’s just two actual sets. But if I’m supposed to do two hard sets of leg press, I’m not going to leg press a couple hundred pounds cold. I’d start with sets of lighter weights and work my way up—so maybe that will be five sets total for the day, but only the working sets count for the 2-2-2 program.

It’s also worth noting that the PDF calls for seven exercises each day. That’s a minimum of 14 sets you’ll do per workout, with most exercises likely requiring at least one or two warmup sets, and some even more. You’ll also rest two to five minutes between sets. Emphasizing “just two sets” makes the workout sound quick and simple, but in practice, it looks like you’ll probably be in the gym a good while. 

What are “reps in reserve”?

Reps in reserve, or RIR, is a great way to explain to experienced lifters how hard they’ll be working in a given set. If you’ve never used RIR before, though, there is a definite learning curve. The idea is that you stop an exercise with two reps “in reserve”—that is, reps that you could have done but didn’t. If you’ve done 10 lat pulldowns and you feel like the eleventh would be really hard and the twelfth would be the last one you could possibly do in this set, then you stop at 10. You’ve left those last two reps “in reserve.” 

This is a common, useful way of talking about exercise intensity—see this explainer from the National Academy of Sports Medicine. But you have to have enough experience with that exercise, and with exercising in general, to recognize the signs your body gives you that you have exactly two reps left. Often, beginners will stop too early, and never get the benefits of going closer to failure before stopping. 

If you’re used to using RIR (or RPE, which is a similar concept), this is a fine way of planning your workouts. If you tend to overestimate your abilities, you’ll probably hit RIR 0 (that is, failure) often enough to teach yourself what those last few reps feel like. But if you’re a person who tends to shy away from those harder reps, or if you’ve never really gone all the way to failure on an exercise, RIR is probably not a good tool for you.

What’s good about the 2-2-2 workout

As a lifter and a trainer, I like the idea of 2-2-2…for a specific kind of person. And yes, probably a lot of the “men over 40” in the target audience qualify as that person. 

Specifically, this is a good workout for people who are already experienced in the gym, but can’t reliably make time for more than two workouts per week. You can get a lot done in two workouts, if each workout covers all your major muscle groups, which it does in this plan. 

The routine does have a plan for progression, which is nice—a lot of trendy workout routines do not. You’ll be doing “double progression,” which means you increase reps of an exercise until you feel ready to increase the weight. At that point you’ll be doing fewer reps, so you start adding reps again. That’s a solid approach that doesn’t take much thinking ahead. (It’s also a missed opportunity to add another “2” to the name.)

What’s overhyped (or misunderstood) about the 2-2-2 workout

My biggest gripe about this workout is just that there’s nothing special about it. It’s basic to the point of being almost common sense: Hey you, do two full-body workouts a week! Make sure each exercise has a few hard sets! Really, no need to overthink it. 

There’s actually nothing special here for “men over 40,” except perhaps that men over 40 are more likely to have kids and other responsibilities taking up their time, and thus will find a twice-a-week schedule convenient. I also find the workout selection biased toward people who stick to machines. On the bright side, you could probably do this whole thing at a Planet Fitness, and that’s going to be convenient for a lot of folks. But I find machines boring. (Maybe that’s a “me” problem.)

In terms of Gonzalez’s actual workout materials, there are a few things that bug me. One is that he talks about the two-workouts-per-week schedule as if it were strongly supported by science as the best option. In reality, two workouts are fine, but people tend to do better with more. No champion bodybuilder or weightlifter hits every muscle twice a week and chills on the couch the rest of the time. Even most recreational athletes with some kind of goal will do better with three or four workouts. Two is enough for most people’s goals, but it’s not necessarily better. 

Promising more results for less work is a staple of the fitness industry, so I’m able to see through it—and of course everybody says their signature workout is the best option. But if you going in thinking the 2-2-2 really is the secret to getting jacked over 40, I beg you to consider that there is never one correct answer to fitness. You can pick any schedule that works each major muscle twice per week, and it will accomplish the same trick. 

Russian Ban On Roblox Gaming Platform Sparks Rare Protest

An anonymous reader quotes a report from Reuters: Several dozen people protested on Sunday in the Siberian city of Tomsk against Russia’s ban on U.S. children’s gaming platform Roblox, a rare show of public dissent as popular irritation over the ban gains some momentum. In wartime Russia, censorship is extensive: Moscow blocks or restricts social media platforms such as Snapchat, Facebook, Instagram, WhatsApp and YouTube while distributing its own narrative through a network of social media and Russian media. Russia’s communications watchdog Roskomnadzor said on December 3 it had blocked Roblox because it was “rife with inappropriate content that can negatively impact the spiritual and moral development of children.”

In Tomsk, 2,900 km (1,800 miles) east of Moscow, several dozen people braved the snow to hold up hand-drawn placards reading “Hands off Roblox” and “Roblox is the victim of the digital Iron Curtain” in Vladimir Vysotsky Park, according to photographs provided by an organizer of the protest. “Bans and blocks are all you are able to do,” read one placard. The photographs showed about 25 people standing in a circle in the snow, holding up placards. In Russia, the ban on Roblox has triggered a debate over censorship, child safety in relation to technology and even the effectiveness of censorship in a digitalized world where children can bypass many bans in a few clicks.


Read more of this story at Slashdot.

Microsoft will finally kill obsolete cipher that has wreaked decades of havoc

Microsoft is killing off an obsolete and vulnerable encryption cipher that Windows has supported by default for 26 years following more than a decade of devastating hacks that exploited it and recently faced blistering criticism from a prominent US senator.

When the software maker rolled out Active Directory in 2000, it made RC4 a sole means of securing the Windows component, which administrators use to configure and provision fellow administrator and user accounts inside large organizations. RC4, short for Rivist Cipher 4, is a nod to mathematician and cryptographer Ron Rivest of RSA Security, who developed the stream cipher in 1987. Within days of the trade-secret-protected algorithm being leaked in 1994, a researcher demonstrated a cryptographic attack that significantly weakened the security it had been believed to provide. Despite the known susceptibility, RC4 remained a staple in encryption protocols, including SSL and its successor TLS, until about a decade ago.

Out with the old

One of the most visible holdouts in supporting RC4 has been Microsoft. Eventually, Microsoft upgraded Active Directory to support the much more secure AES encryption standard. But by default, Windows servers have continued to respond to RC4-based authentication requests and return an RC4-based response. The RC4 fallback has been a favorite weakness hackers have exploited to compromise enterprise networks. Use of RC4 played a key role in last year’s breach of health giant Ascension. The breach caused life-threatening disruptions at 140 hospitals and put the medical records of 5.6 million patients into the hands of the attackers. US Senator Ron Wyden (D-Ore.) in September called on the Federal Trade Commission to investigate Microsoft for “gross cybersecurity negligence,” citing the continued default support for RC4.

Read full article

Comments