DEV Community

Cover image for France's gigabyte tax, the ChatGPT shared-link account bug, Scribd's breach and Tangled's federated forge
Nikoloz Turazashvili (@axrisi)
Nikoloz Turazashvili (@axrisi) Subscriber

Posted on

France's gigabyte tax, the ChatGPT shared-link account bug, Scribd's breach and Tangled's federated forge

#security #webdev #opensource #news

Four developer stories from Saturday, October 31, 2026, each read from its own primary source. The first is a French tax on gigabytes that passed the National Assembly by one vote. The video has the walkthrough; this article keeps the quotes, numbers and links in one place. English renderings of the French text are ours.

TL;DR

  • France's National Assembly adopted amendment I-1358 to the 2027 budget bill on October 30: 0.055 euros per gigabyte, owed by the company that sends the data to French internet subscribers. The vote was 11 to 10, in the first reading. It is not law.
  • The security firm Parameter says it took over ChatGPT accounts through a public shared-conversation link. OpenAI rated the report P1 and confirmed the fix on October 26. The account of the flaw is Parameter's.
  • Scribd, the company behind Slideshare, Everand and Fable, has a security incident notice on its help center and is emailing affected users in phases. It has not said how many accounts were affected.
  • Tangled released a federated code forge on the AT Protocol. Issues and pull requests now live on the server you host, as Git objects. It is Tangled's own announcement.

France: a tax on gigabytes, adopted by one vote

On Friday, October 30, 2026, the National Assembly adopted amendment I-1358 to the finance bill for 2027 (bill no. 3210). It was filed on October 9 by the Socialist group and defended in the chamber by Laurent Lhardit. The committee had rejected the same text on October 9.

The amendment adds a chapter to the French tax code titled "Taxe sur les producteurs de données numériques". Article 302 bis ZP reads: "Il est institué une taxe assise sur les flux de données numériques émises par les fournisseurs de contenu et acquittée par ces derniers." In our translation: a tax is created on the digital data flows sent by content providers, and paid by them.

Three mechanics matter for anyone who serves traffic to France:

  1. Who counts the data. Internet service providers must set up a consolidated, anonymized collection of the quantities of data flowing to their customers, identifying the sender. The collection includes the sender's identity and its registration number with the Internet Assigned Numbers Authority, and the quantity sent. The text says no record of the content of the data or of its destination can be required, and the figures go to the tax administration every quarter.
  2. Who pays. Article 302 bis ZR says the sender owes a tax equal to the volume of data, in gigabytes, multiplied by 0.055 euros. Subscribers are not the taxpayers, and neither are the providers: they only report the counts. A hundred gigabytes comes to 5.50 euros.
  3. Content delivery networks. When a sender uses a CDN, the quantity of data counts as the sum of the flows leaving the CDN.

The tax is capped at a maximum of 15 percent of the sender's revenue in France or 2 percent of its total revenue. Groups with a French entity pay as they would corporate tax; groups without one pay in euros by March 30 of the following year, on a notice issued by January 30.

What the sponsors expect

The amendment's explanatory note expects a yield of 10 billion euros and cites an estimate from the regulator ARCEP of 200 billion gigabytes a year sent to subscribers of French internet providers. It names Google, Meta, Amazon, Netflix and Akamai as half of the measured traffic. Our arithmetic: 200 billion gigabytes at 0.055 euros is 11 billion euros, one billion above the figure in the note. The note does not explain the difference.

The debate

Philippe Juvin, the Assembly's budget rapporteur, gave an unfavorable opinion: the risk, he said, is that the large platforms pass the cost on to advertisers. The minister, David Amiel, also opposed it. He said the scheme would need flow sensors or measurement at the receiving terminals, and that half of the tax, 5 billion euros on the sponsors' own figure, would fall on smaller content providers, notably French ones. Lhardit answered that free services such as Facebook, Instagram or TikTok have no user to pass a tax on to, and said by his evaluation the cost for the TF1 group would be between 200,000 and 300,000 euros.

The public vote was requested by the Socialist group. Thirty five members voted, 21 votes were counted, 11 for and 10 against.

Is it law?

No. The Assembly adopted one amendment in the first reading of the budget bill. French press coverage, including Europe 1, notes that it can still be changed or removed during the rest of the debate and in the exchanges with the Senate. The amendment text we read sets no start date. I covered a different French measure on October 23, when Quad9 said it would stop serving users in France after a court ruling; this one targets traffic itself.

What to do: nothing today. If you send large volumes to French users, watch the Senate stage and ask your CDN whether it reports egress per country.

ChatGPT: a shared link that ran code as chatgpt.com

Parameter Labs published "Do the Math: How We Took Over ChatGPT Accounts" on October 28, with status Fixed and severity P1. Its summary: an attacker could create a malicious conversation, publish it with ChatGPT's normal sharing feature and send the link to another user. When the victim opened it, code ran as chatgpt.com in the victim's signed-in session.

As Parameter describes the chain, it combined ordinary features. ChatGPT's HTML Preview runs code in a restricted frame on a different web address, and that isolation worked: the Preview could not read the main page. A graph in the same conversation loaded a math library, which installed a listener in the main page for messages related to its on-screen keyboard. The listener accepted a message without proving which frame sent it, and the message format allowed HTML. The HTML created a new frame in the main page that inherited the chatgpt.com identity. Parameter says a script policy workaround was the last step and that the root cause was the message listener.

Parameter says its proof of concept listed a victim's recent conversations, read a private one that had never been shared and sent a small piece of it to a server the researchers controlled. In the automatic version, opening the link was the victim's only click.

The timeline in the post: Parameter submitted the report to OpenAI's bug bounty on October 18. On October 21 OpenAI reproduced it and raised the severity from P2 to P1. One web frontend was fixed on October 22 while a second was still being updated, content security policy changes blocked part of the chain on October 23, and on October 26 OpenAI confirmed both frontends rejected the reported messages, marked the issue resolved and awarded a total bounty of 5,000 dollars. We found no statement from OpenAI itself, so the account of the flaw and of OpenAI's actions is Parameter's.

The defensive lessons Parameter lists are plain: verify both the sender's origin and the exact window before acting on a message, keep raw HTML out of cross-window settings, keep dynamically created documents sandboxed when an untrusted frame can influence them, and treat content security policy as a backup. ChatGPT is a web app, so there is nothing to update on your side. It is a good day to grep your own message handlers for event.origin and event.source checks.

Scribd: what the notice says

Scribd's help center notice, last updated October 1, says an unauthorized third party gained access to its systems, used that access to reach other internal systems and accessed certain user information: basic account information for most accounts, more sensitive information for a smaller number. It says it closed the vulnerability, engaged outside forensic experts, notified law enforcement and the relevant data protection authorities, and began notifying affected users through its provider Epiq. It recommends resetting passwords for Scribd, Slideshare, Everand and Fable accounts.

A user posted an email notice on Hacker News on Monday, October 26, that lists what may have been accessed: the email address, the last four digits of the credit card, the country, the card issuer, the card expiry date and payment history, which the notice says excludes credit card details. It says there is no evidence the data has been misused. The Romanian outlet Business24 reports that notices sent to users there also list the titles they read or searched.

Scribd's notice gives no dates for the intrusion and no number of affected accounts, and says notices go out in phases, so not receiving one does not mean an account was spared. What to do: reset the password on all four sites, change it anywhere you reused it, and verify any call or email that knows your card's last four digits through your bank's own number, because a scammer may know them too.

Tangled: a federated code forge

Tangled, a code forge built on the AT Protocol, announced a major release on October 30 and calls itself "the first truly federated code forge". You can host the Git side on your own server, which Tangled calls a knot, and still collaborate with people on other knots.

The change that matters is where the discussion lives. Issues, pull requests, comments, reactions and labels are now stored on the knot, next to the code, as collaborative objects: a chain of Git objects in the repository itself. To keep a knot from putting words in your mouth, every time you create or edit a record the web app also writes an attestation record to your own personal data server, pointing at that exact version. Tangled calls it two-way verification.

The post also describes how the service itself changed. The web UI and backend used to be one Go monolith on a single SQLite database on one medium-sized server in Sweden. The new frontend is written in Svelte and deployed at the edge, populated by a read-only, in-memory indexer written in Rust that runs in more than 11 regions. The knot server was rewritten in Rust as well. The release adds organization accounts and stacked pull requests with interdiffs.

Self-hosters must upgrade their knots to v1.20.0 following the upgrade guide. Tangled says private repositories, a CLI, SDKs and agent skills are coming over the next few weeks. This is the project's own announcement and we found no independent review yet.

Verdict

NEEDS REVIEW. The French tax passed by one vote and is not law yet, the ChatGPT fix is described only by the researchers, Scribd has not said how many accounts were hit, and Tangled's federation claim is its own.

Sources

This article expands on an episode of **The Daily Diff, a five-minute daily video on what shipped and what broke in tech.
Watch the episode · Subscribe on YouTube · the written diff lands in your inbox every morning at thedailydiff.dev.

Video transcript and primary sources

Top comments (0)