CBMPET2001

Eh, with something this horrendously egregious I think their customers have a right to know how carelessly their data was handled, regardless of the remediation steps taken after disclosure; that aside, who knows how many other AI SaaS vendors might stumble across this article and realize they've made a similarly boneheaded error, and save both themselves and their customers a huge amount of pain . . .

I've seen that exact pattern used to safely unwrap a weakly captured 'self' within a closure (to avoid retain cycles)

Ah, so the 'signed checksum' field isn't actually the checksum of the signed document? How odd . . . but yeah, now that I think about it, they couldn't know the hash of a document before they generate it, but they would need to in order to include it in the document, hence an impossible cycle; they must have overlooked that . . .

I think they're referring to the 'signed checksum' field on the document, and this line from the article

> Interestingly, the certificate page was identical in both documents, including the checksums, despite the content being different.

I think they took this to mean that the signed copy and the copy with the fraudulent addendum both hashed to the same checksum, but I'm not sure that's what was meant; based on the article it's not obvious to me that OP was able to check the signed checksum, though I can't imagine they didn't try. It's the 'original checksum' field that matched the base.pdf clean document without signature or addendum.

OP mentions in the article that the draft was uploaded on 9/22/25, so it can't have been a simple mix up where the version with the addendum was the one they had originally intended to have signed, since it didn't exist yet.

If you just mean that they had the second version in their system but never intended to send it at all, then I'm not sure what possible innocent explanation there would be for uploading a newly modified version of an already signed lease that's run its course.

Per the post, the takedowns are due to false positive malware flags, not because of copyright takedowns. So I guess the unmodified, 100% genuine ROMs don't trip the malware detection, whereas the mods do?

True, but Apple and Google were never any impediment to that beyond just skimming some off the top.

I'm not sure how Spanish criminal law works, but even if it does work like in the US, the press release doesn't actually mention any seized funds or property at all

If that were the case then they wouldn't have shut down the scheme and arrested the perpetrators

Sixth (and this one is pretty indisputable): https://en.wikipedia.org/wiki/LAM_Mozambique_Airlines_Flight...

Not sure that such a heavily edited two-minute clip is fully representative of the over hour and a half-long meeting (which also includes a presentation detailing the years worth of science done in the leadup to that meeting)[0]

[0]https://www.youtube.com/watch?v=wAWGpASZexI