France's gigabyte tax, a ChatGPT shared-link account takeover, the Scribd breach and Tangled's federated code forge: four developer stories in one Daily Diff

What this video covers

• On Friday, October 30, 2026, the French National Assembly adopted amendment I-1358 to the 2027 budget bill (first reading, bill no. 3210), which creates a tax on digital data flows sent by content providers. The text sets 0.055 euros per gigabyte, owed by the sender; internet providers count the data going to their customers by sender, anonymously and without looking at content, and report it quarterly to the tax administration, and a content delivery network's outflow counts as the sender's. The vote was 11 for and 10 against among 21 counted votes, with 35 members voting, against the opinions of the budget rapporteur and the minister. The English renderings of the French text in this video are ours.
• The amendment caps the tax at 15 percent of the sender's revenue in France or 2 percent of its total revenue. Its explanatory note expects about 10 billion euros and cites an ARCEP estimate of 200 billion gigabytes a year sent to French subscribers; 200 billion times 0.055 is 11 billion, and the note does not explain the difference. The same text was rejected in the finance committee on October 9. The measure is not final: it can still be changed or removed in later Assembly votes and in the Senate, and the text read for this video sets no start date.
• Parameter Labs says it took over ChatGPT accounts using a public shared-conversation link. According to its post of October 28, 2026, a chain of ordinary features, an HTML Preview in a restricted frame, a graph that loaded a math library with a message listener in the main page, and a listener that accepted a message without checking its sender, let its code run as chatgpt.com in the victim's session, list conversations and read a private one. It reported the bug on October 18; OpenAI reproduced it, raised the severity from P2 to P1, confirmed on October 26 that both web frontends rejected the messages, and awarded a 5,000 dollar bounty. The account of the flaw is Parameter's.
• Parameter advises checking both the sender's origin and the exact window in message handlers, never accepting raw HTML in cross-window messages, and treating Content Security Policy as a backup control. It reports that the Preview sandbox itself held; the problem was a listener in the main page.
• Scribd's help center notice, last updated October 1, 2026, says an unauthorized party got into its systems, reached other internal systems and accessed user information: basic account information for most accounts and more sensitive information for a smaller number. It says the vulnerability was closed, outside experts were engaged, law enforcement and data protection authorities were notified, and it recommends resetting passwords for Scribd, Slideshare, Everand and Fable. A notice posted on Hacker News on October 26 lists the email address, the last four card digits, card issuer, expiry date, country and payment history, and says there is no evidence of misuse. Scribd has not published how many accounts were affected.
• Tangled, a code forge built on the AT Protocol, announced a major release on October 30, 2026 and calls itself the first truly federated code forge. Repositories can be hosted on your own server (a knot) while collaborating with other knots. Issues, pull requests and comments are now stored on the knot as chains of Git objects, and each edit also writes an attestation record to the author's own personal data server. The web app moved from a single Go program on one SQLite database in Sweden to a Svelte frontend at the edge with a read-only Rust indexer in more than 11 regions. Self-hosters must upgrade knots to v1.20.0; private repositories, a CLI and SDKs are listed for the next few weeks. These are Tangled's own claims.

Transcript

Cold open: who pays for a gigabyte in France?

0:00 Internet taxes usually count revenue or profit. France's National Assembly just adopted one that counts gigabytes, five and a half euro cents each, by eleven votes to ten. In this video, four stories. Who pays France's gigabyte tax, and is it law yet? How did a shared ChatGPT link reach private chats? What did Scribd say was taken? And what is a federated code forge?

0:24 One number in the French text does not quite add up. I will check it at the end. It's Saturday, October thirty first, and this is The Daily Diff. A gigabyte tax charges a company for every gigabyte it sends to people, whatever the company earns. Think of a toll booth on the internet that counts bytes instead of cars, and most of the cars are cat videos.

Story one: who pays France's gigabyte tax, and is it law yet?

0:44 Story one. On Friday, the National Assembly adopted amendment thirteen fifty eight to the twenty twenty seven budget bill. It sets five and a half euro cents per gigabyte, owed by the company that sends the data to French subscribers. The text has three moving parts. Internet providers count the data flowing to their customers and report who sent it, every quarter, without looking at content. The sender owes the tax; subscribers owe nothing.

1:09 If the sender uses a content delivery network, what leaves that network counts as the sender's. Here is the rate, from the French text. The sender owes the volume in gigabytes times five and a half cents. A hundred gigabytes comes to five euros fifty. A cap limits the bill to fifteen percent of the sender's French revenue, or two percent of its total revenue. The English is our translation.

1:34 The committee rejected the same text on October ninth. On Friday, the budget rapporteur warned that big platforms could pass the cost to advertisers. The minister said it would need flow sensors, and that half the tax would land on smaller, notably French, providers. The author, from the Socialist group, answered that the services are free, so there is nothing to pass on. Thirty five members voted. Of the twenty one votes counted, eleven said yes and ten said no.

2:01 It is still only an amendment in the first reading of the budget bill, so later Assembly votes and the Senate can change or remove it. The text I read sets no start date. On October twenty third I told you Quad9 is leaving France after a court ruling. This time the target is the traffic itself. If you send a lot of data to French users, watch the Senate, and ask your CDN what it reports per country. Story two. The security firm Parameter published how it took over ChatGPT

Story two: how did a shared ChatGPT link reach private chats?

2:29 accounts using nothing but a shared conversation link. It reported the bug to OpenAI on October eighteenth. OpenAI rated it P one, and on October twenty sixth confirmed the fix. Parameter describes the chain. Preview runs HTML in a restricted frame on another address. A graph on the same page loaded a math library that listens for messages in the main page. That listener accepted a message without checking who sent it, and the message could carry HTML.

2:57 The HTML made a new frame, which ran as chatgpt dot com. In the automatic version, opening the link was the only click. Parameter says its test code listed the victim's conversations and read a private one. It sent only a small piece to its own server to prove it, and OpenAI paid a five thousand dollar bounty. The Preview sandbox itself held. The hole was the listener in the main page. Parameter advises checking both the sender's address and the exact window,

3:26 and never accepting raw HTML in a cross window message. It is a good day to grep your own message handlers. Story three, a short one.

Story three: what did Scribd say was taken?

3:34 Scribd, the company behind Slideshare and Everand, has a help center notice about a security incident, last updated October first. It says an unauthorized party got into its systems, then reached other internal systems and user information. For most accounts, Scribd says, that meant basic account information. For a smaller number, more sensitive information was involved. A notice a user posted on Hacker News on Monday lists the email address and the last four card digits.

4:02 It also lists the card issuer and expiry date, plus country and payment history. Scribd says there is no evidence of misuse. Notices differ by person. A Romanian outlet, Business 24, reports that notices there also list the titles people read or searched. Scribd has not said how many accounts were affected, and it says notices go out in phases, so no email does not mean you were spared. What to do.

4:29 Scribd asks you to reset your password on all four sites, so do it, and change it anywhere else you reused it. Be wary of any call or email that knows your card's last four digits, because a scammer may know them too.

Story four: what is a federated code forge?

4:42 Story four. Tangled, a code forge built on the AT Protocol, the open protocol Bluesky runs on, shipped a big release on Friday. It calls itself the first truly federated code forge. You can host your repositories on your own server, which Tangled calls a knot, and still collaborate with people on other knots. The change that matters is where the discussion lives. Issues, pull requests and comments are now stored on the knot, right next to the code, as chains of Git objects.

5:09 A knot could try to put words in your mouth, so each edit also writes a record to your own personal data server. Tangled calls it two way verification. Until this release, the whole web app was one Go program on a single SQLite database on one server in Sweden. Now it is a Svelte frontend at the edge, plus a read only indexer in Rust that runs in eleven or more regions. If you self host, the release asks you to upgrade your knots to version one

5:38 point twenty. Private repositories and a command line tool are listed for the next few weeks. This is Tangled's own announcement, and I found no independent review yet.

Back to France: does the gigabyte sum add up?

5:47 Now the sum I promised. The French amendment's own note cites two hundred billion gigabytes a year sent to French subscribers. At five and a half cents each, that is eleven billion euros. The note promises ten billion. It does not explain the gap. If you'd rather read this than hear me say it, the diff lands in your inbox every morning, free at the daily diff dot dev, link below.

6:10 So today's verdict is NEEDS REVIEW.

Verdict: NEEDS REVIEW

6:13 I'd review it because the French tax passed by one vote and is not law yet, the ChatGPT fix is described only by the researchers, Scribd has not said how many accounts were hit, and Tangled's federation claim is its own. Subscribe, hit the bell, and tell me in the comments if you'd have stamped it differently. And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.

Sources

1. Amendement n°I-1358, Projet de loi de finances pour 2027 (adopted October 30, 2026)Assemblée nationale
2. Compte rendu de la première séance du vendredi 30 octobre 2026Assemblée nationale
3. Amendement I-CF365 (rejected in the finance committee)Assemblée nationale
4. Budget 2027 : les députés votent une taxe au gigaoctetEurope 1
5. Do the Math: How We Took Over ChatGPT AccountsParameter Labs
6. Information about the recent security incidentScribd Help Center
7. Tell HN: Scribd Breached (notice text as posted by a user)Hacker News
8. Scribd notifică utilizatorii din România privind un incident de securitateBusiness24
9. The federated code forgeTangled