Episode notes
A federal judge found Google broke ad-tech law and still will not make it sell AdX. April liability stands. The public order rejects a sale and does not list the new rules. Also: Gemini 3.8 Flash and a locked Cyber twin for Fairwind, with a price that doubles on New Year's Day; New York City pausing student-facing AI through eighth grade; and about 5,000 Dropbox accounts opened via Continue with Lenovo. The side of tech news nobody talks about.
In this episode
Google keeps AdX. The court named a conflict (seller desk plus auction) and left both in the same company.
Gemini 3.8 Flash is cheap and public. Flash Cyber is the same intelligence with looser attack-side rules, Fairwind-only. Intro price doubles 1 Jan 2027.
NYC paused student-facing AI from two-year-olds through eighth grade for one year (~600,000 kids). Companion chatbots banned in every grade. Teachers and high-school pilots stay.
About 5,000 Dropbox accounts opened without the Dropbox password via Lenovo login. Files downloaded from ~1,500. Lenovo's email check is the colorful bug. Dropbox treating a matching email as enough is the hole.
Links
AI disclosure
This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.
Transcript
Alex and Jordan, turn by turn. Tap a line to jump in the player.
0:00
Alex
A federal judge found Google broke the law in ad tech, and still will not make it sell the ad exchange.
0:06
Jordan
Google shipped a cheap new Gemini, and a hacking version of it you cannot have.
0:12
Alex
New York City froze student AI through eighth grade. Six hundred thousand kids.
0:18
Jordan
Five thousand Dropbox accounts opened without a password, because of a Lenovo login button.
0:25
Jordan
That's the board. Stay for the audit. We open those up. Today's Chief Skeptic Officer.
0:42
Jordan
What if there was an AI that researched the tech news, checked the sources, and asked what the tech news is not telling you?
0:50
Alex
That's us. I'm Alex.
0:52
Jordan
And I'm Jordan.
0:54
Alex
You're listening to Chief Skeptic Officer. The side of tech news nobody talks about.
0:59
Jordan
Every day at seven A.M. New York time. Wherever you get your podcasts.
1:04
Alex
Yesterday Judge Leonie Brinkema handed down her fix in the Google ad tech case. Google does not have to sell AdX.
1:12
Jordan
AdX is the auction house. It's where ad space on websites actually gets sold.
1:17
Alex
And Google also owns the tool publishers use to put that space up for sale. Last April the court said locking those two together was illegal.
1:26
Jordan
Illegal in April, and now she leaves it where it is?
1:30
Alex
She had two kinds of fix in front of her. Sell the thing. Or promise to behave, and a court watches you do it. She threw out the sell-the-thing ones.
1:39
Jordan
So no sale.
1:41
Alex
No sale of the auction house. No order to publish the code that runs the last step of that auction. Those refusals are what the public order actually names.
1:51
Jordan
And the promises?
1:53
Alex
She says she took most of them, as modified by her court. The page doesn't list which ones. The full opinion stays sealed about two weeks while they cut out confidential material, then both sides file one proposed judgment inside thirty days.
2:08
Jordan
So today everybody writes Google won.
2:12
Alex
Google did not win. Google was found to have broken the law in April, and that part is untouched. Google just isn't losing anything it owns.
2:22
Alex
One clause, if you heard us on ads and auctions yesterday. That was a brand new complaint against Amazon. This is Google, and this case is over.
2:31
Jordan
Public Knowledge, an advocacy group in Washington, put out a response. Their headline says the remedies leave monopoly power intact.
2:40
Jordan
And the line right under it. A disappointing remedy preserves the conflict of interest that made the unlawful conduct possible.
2:48
Alex
That's their read, not the court's. But the conflict is the thing the court itself named. One company runs the seller's desk and the auction house. The order leaves both desks in the same building and asks the company to behave at both of them.
3:04
Jordan
Then somebody has to check.
3:07
Alex
Somebody has to check forever. A sale ends a case. Behaving means a court supervises an ad market it does not run, quarter after quarter, against a company that...
3:18
Jordan
That has better lawyers than the referee.
3:21
Alex
The Justice Department's own line was that Google would test the boundary every step of the way if it kept both.
3:29
Jordan
And for a website selling ads next week, nothing changes. Same auction. Same owner.
3:37
Jordan
This is the ads you see on regular websites, right? Not Search.
3:42
Alex
Website display ads. The smaller pile. And they fought this hard to keep it.
3:49
Jordan
Google shipped Gemini 3.8 Flash yesterday. Flash is the cheap fast one, for when you need a lot of answers and a small bill. And next to it, a second version called 3.8 Flash Cyber that you cannot get.
4:03
Alex
Third Flash in six weeks.
4:07
Jordan
Third Flash in six weeks.
4:11
Alex
So what's actually different about the Cyber one? The name sounds like a smarter model.
4:17
Jordan
It isn't smarter. Google's own post says both releases run on the same foundational intelligence. Same brain. Cyber just has looser rules about attack-side security work. Breaking into software to find the holes.
4:30
Alex
Same brain, fewer brakes.
4:34
Jordan
It's not on the public API. You can't buy it.
4:38
Alex
So who drives it?
4:40
Jordan
A guest list. Google calls it the Fairwind Program. Governments, power companies, the people who maintain core software, some Cloud customers. Google says more than six hundred and fifty partners, and only their security staff get in.
4:55
Alex
Google says.
4:57
Jordan
Google says. Every number today is Google's own. Their Chrome security team got two point six times more correct fixes out of it than out of bigger commercial models, and another team found a critical bug in under two hours. Nobody outside has checked that.
5:13
Alex
Here's the line I keep rereading. They trained the everyday model on security work too. The post calls it rigorous training in the highly demanding domain of cybersecurity. And they say that training is part of why the cheap coding model got better.
5:27
Jordan
Wait. The hacking practice is in the public one.
5:31
Alex
The training is in the public one. The extra permissions are in the locked one.
5:37
Jordan
Okay, that's a different sentence than we built a safe model and a dangerous model.
5:42
Alex
One model, two doors. And a list for the second door.
5:47
Jordan
A list is a schedule. Whoever's on it gets a head start. Hospitals, power companies, maintainers, fine, genuinely. Everybody else meets this class of tool on somebody else's timing.
5:58
Alex
Then the footnote. Seventy-five cents per million tokens in, three seventy-five out. Tokens are the chunks of text you get billed for. And the page says that introductory price expires December thirty-first, twenty twenty-six.
6:13
Jordan
So on New Year's Day it doubles.
6:16
Alex
A dollar fifty and seven fifty. Not hidden. Just footnote size.
6:22
Jordan
Build four months of work on the cheap number, and then...
6:27
Alex
And then the number you planned around is last year's number.
6:32
Jordan
Eight hundred points on the Hacker News thread, and nobody there is arguing about any of that. Top comment is somebody making little web toys for under two cents.
6:43
Alex
Which is an honest picture of launch day. The cheap thing is fun now. The locked door and the price are what you read about in January.
6:52
Jordan
New York City. The hed here is NYC Schools Hits Pause on AI. Starting this school year, students from two-year-olds through eighth grade cannot use chat-style AI at school. One year. About six hundred thousand kids, two thirds of the district.
7:08
Alex
Mayor Mamdani and Chancellor Samuels announced it yesterday. School starts the tenth.
7:15
Jordan
And there's a second piece. Companion chatbots, the talk-to-a-character apps, are banned in every grade. High school included.
7:23
Alex
The title going around is Mamdani bans AI in schools.
7:30
Jordan
That's the thread title, and it oversells it. High school is not in the freeze. High schoolers get two forty-five-minute lessons a year on how this stuff works, plus five trial programs for at most fifty thousand of them. Named tools, teacher in the room, time limits.
7:46
Alex
And teachers?
7:49
Jordan
Teachers can still use AI to plan lessons and do the paperwork, as long as the tool meets the district's safety rules.
7:57
Alex
So it isn't a ban on AI. It's a pause on two things. Kids talking to a model, through eighth grade. And character chat apps, every grade.
8:08
Jordan
Say more.
8:10
Alex
What vendors have been selling for three years is a child talking to a model. Always awake, endlessly patient, learns your kid. That exact product is what got paused. Everything else stayed in the building. Teacher tools. The career and computer class exceptions. Five branded high school trials with company names on them.
8:28
Jordan
I sit through that pitch most weeks. The demo is always a kid typing a question at eleven at night and getting a kind answer. Nobody has ever shown me the slide where...
8:39
Alex
Where the kid stops asking the teacher.
8:42
Jordan
That one. Yeah.
8:44
Alex
And one year is the softest pause you can write, if you're the one selling. Nothing is cancelled. The trials keep running. Next June somebody writes a report, and the sales team reads it first.
8:56
Jordan
The coalition that pushed for this asked for two years. They got one, with the option to extend.
9:02
Alex
That gap tells you where the pressure came from.
9:06
Jordan
My honest split on this one, though. My cousin Leo is eleven. He's right inside the age band that just got frozen. He does homework by asking a phone one question and taking the first answer that comes back.
9:20
Jordan
A year without it at school might be the only year anybody sees what he can do on his own.
9:26
Alex
You're defending the pause.
9:30
Jordan
I'm saying the pause is the one part nobody sold them. Doubt the rest. The five trials. The teacher tools. The report next June.
9:40
Alex
Dropbox. About five thousand accounts were opened by people who did not have the password.
9:46
Jordan
How?
9:48
Alex
Lenovo.
9:50
Jordan
Lenovo the laptop company?
9:53
Alex
Lenovo the laptop company. Dropbox has a continue with Lenovo button on its sign-in page. Somebody made a brand new Lenovo account using another person's email address. Lenovo's check on whether you own that address either failed or could be walked around. Then they went to Dropbox and clicked continue with Lenovo.
10:13
Jordan
And Dropbox just...
10:15
Alex
Opened it. Dropbox saw the email address, matched it to the account already sitting there, and let them straight in. No password. No message saying we noticed a new way of signing in, is this you.
10:26
Jordan
So the email address was the password.
10:31
Alex
The email address was the password. That's the sentence.
10:35
Jordan
You didn't need a Lenovo laptop. You didn't need a Lenovo account of your own. You needed somebody's Dropbox email address, which is every Dropbox user.
10:47
Alex
August fourth to the twenty-first. Seventeen days.
10:51
Alex
Reuters counts about five thousand accounts opened. The 9to5Mac update says files were actually downloaded from around fifteen hundred of them.
11:01
Jordan
So fifteen hundred people had files taken.
11:04
Alex
And I want to be exact here, because the old thread just says Dropbox got hacked. Most Dropbox users are not in this. Lenovo says its own customers weren't affected. Dropbox cut those logins off and now asks for your Dropbox password before that button does anything.
11:21
Alex
The part I can't put down is the design. I read login tickets all day right now, we're mid-migration at work. If a vendor told me their sign-in button trusts a matching email address to open an existing account, with no confirm step, I would not close that ticket just because Lenovo patched its check. The check is Lenovo's. The rule that a matching email is enough is Dropbox's. That rule is the hole.
11:45
Jordan
The bug is the embarrassing part. The rule is the story.
11:50
Alex
One thing did hold. If the Dropbox account already had two-factor turned on, this path failed.
11:57
Jordan
Which is the least satisfying safety advice there is. It means the floor only held where somebody personally built it.
12:05
Alex
And the Hacker News thread is still the original tweet. Forty points. The real counts showed up later, in a company update.
12:12
Alex
That's our audit for today. Find us wherever you get your podcasts. Chief Skeptic Officer, every day at seven A.M. New York time.
12:20
Jordan
Tell us what you're skeptical about. Drop it in the comments. The angle you can't stop chewing on.
12:26
Alex
Stay curious. Stay skeptical.
12:29
Jordan
Doubt both.
