Wetherspoons has stopped short of banning Meta-style smart glasses from its pubs, but told The Register that customers should switch off their cameras and refrain from filming. "Like many hospitality companies, Wetherspoon has CCTV cameras for security reasons, but their use is strictly controlled by data legislation," a spokesperson said. "Apart from that, the general code that applies in our pubs, and most pubs, is that you can't film customers or employees without their permission. "Meta glasses seem to breach this code, and common sense, by enabling surreptitious surveillance, so our instinct is to say turn off the cameras. This is akin to our efforts to stop audible playing of videos in our pubs, which also invades people's space." The Register asked whether customers who refused to stop recording would be ejected, but Wetherspoons declined to elaborate. Wetherspoons' statement suggests that recording, rather than merely wearing the glasses during a wallet-friendly session, would attract the attention of security staff. The policy is therefore less strict than those adopted by venues and events that have banned recording glasses outright over privacy concerns. DEF CON, which concluded last week, was the latest in a series of organizations to issue outright bans on Meta-style recording glasses, even for those who use them with prescription lenses. Conference organizers told delegates to pack "non-violating eyewear" if they needed them. Monopoly Events, which runs UK Comic Cons among other events, recently imposed a ban after talent agencies and guests raised concerns about privacy and the effect of covert recording on personal interactions. Scottish ferry operator CalMac also temporarily suspended unplanned visits to ships' bridges after a passenger made crew members feel uncomfortable during a crossing in June. Restaurateur Jeremy King, who owns London's Arlington, The Park, and Simpson's in the Strand, has said the glasses should not be worn in his establishments. Similarly, private members' club Soho House does not allow recording inside its venues, a policy that extends to Meta-style glasses. Brighton's Yellow Book Bar called the glasses "creepy and intrusive" when announcing its ban, and theatre companies ATG Entertainment and Trafalgar Entertainment do not permit them either. Meta's smart glasses have become shorthand for the wider category of camera-equipped eyewear. Google unveiled Glass in 2012 but failed to turn it into a mainstream consumer product. Meta and EssilorLuxottica launched their first Ray-Ban Stories glasses in 2021, followed by the second-generation Ray-Ban Meta range in 2023 and an expansion into Oakley-branded models. Meta's glasses have become the most prominent products in the category, prompting other tech companies to work on rivals. The next-gen eyewear has proven especially popular among social media users, allowing them to record high-res, hands-free, and first-person footage with ease. Unlike Google Glass, however, the wearables are largely indistinguishable from their analog counterparts, which makes their recording capabilities all the more problematic. The camera in Meta's specs is small and embedded neatly inside the glasses' frame. The company routinely highlights that each pair is fitted with a recording light, which activates when the user begins shooting video, and that if this light is covered up, then recording immediately stops. The feature has done little to appease those who feel the cameras are an invasion of privacy. UK law does not generally prevent individuals from filming in public, although pubs are private premises and may set their own rules. Smart glasses make those rules harder to enforce because recording is far less conspicuous than when someone points a smartphone at the scene. Researchers have shown that Meta's glasses can be paired with apps that can dox passersby in seconds. Others have worked up projects that inform Android users of nearby glasses-wearers using Bluetooth signals. Meta faces a UK data protection probe concerning the cross-border data flows of its glasses' footage after Kenyan reviewer teams reported seeing footage from wearers' more intimate moments. ®

Modular laptop maker Framework has warned customers that an attacker exploited a zero-day at analytics provider Metabase to access names, email addresses, phone numbers, physical addresses, and login IP addresses, according to an email shared on Reddit. For business customers, the exposed information may also include company names, phone numbers, VAT or Employer Identification Numbers (EINs), and billing email addresses. Framework said order and payment details were not affected. "We are deeply sorry for this breach of information, and are reviewing and improving our methodology for data storage in external database vendors," Framework said, adding that it's notifying regulators where required, though it noted that names, email addresses, phone numbers, and physical addresses don't cross the mandatory reporting threshold in many regions. Customers are getting the heads-up regardless. Framework didn't immediately reply to The Register's questions, but told TechCrunch that the breach had affected "all customers." The intrusion began with a zero-day vulnerability in Metabase, the business intelligence platform Framework uses to analyze its data. In its own blog post, Metabase said an attacker targeted its cloud service using a previously unknown vulnerability affecting versions 1.58 and later. The company blocked the endpoints used in the attack, patched the bug, and deployed the fix across its cloud service. Framework's account provides a timeline for the break-in. Metabase discovered the attack on August 3 and notified Framework at 9am Pacific Time on August 6, telling the laptop maker that its instance had been vulnerable and that the attacker had successfully gained access to it. Framework said it then rotated credentials for every database connected to its Metabase instance and found no changes to admin access or evidence that systems outside Metabase had been accessed. The company has also brought in a third-party forensics firm to investigate, and cautioned that its findings so far are preliminary. According to Metabase, exploitation can allow an attacker to inject arbitrary SQL against the application's database and potentially gain administrator access. From there, they could alter configuration settings, steal credentials for databases connected to Metabase, query data those connections can access, and export the results. Metabase told anyone running their own instance to patch immediately. If the vulnerable password-reset endpoint was exposed to the internet, admins have more work ahead of them: killing active sessions, checking for rogue API keys or admin accounts, rotating database credentials, and digging through logs for anything suspicious. Framework is reviewing how customer information is made available through external analytics services, but hasn't yet said what changes that review might produce. The breach lands during an already bumpy spell for Framework and its customers. In July, the repairable PC maker warned that the price it was being charged for LPCAMM2 memory used in its Laptop 13 Pro had more than doubled, forcing it to raise memory prices rather than swallow the increase. It also warned that CPU prices were heading upward and could push overall system prices higher in the coming weeks. Being able to replace almost every part of your laptop is handy. Finding your home address exposed through an analytics service is rather less so. ®

ON CALL Fronting up to work on Friday morning can feel like a mistake, but The Register tries to make it worthwhile by bringing you a new installment of On Call – the reader-contributed column that shares your tech support stories. This week, meet a reader we'll Regomize as "Lee" who told us about his time as sysadmin at the headquarters of a retail company. "It was about the year 2000 and I was a newly minted Certified NetWare Engineer administering Novell servers," Lee reminisced. Before long, Lee was running the teams that managed email servers and provided desktop support for over a thousand users. "I got to know just about everybody in the HQ and became known as the go-to guy for all things technical," he proudly told On Call. One Friday afternoon, a vice president called to complain he couldn't access any files from his PC because someone else was using them. Lee found this a little odd, so he asked if the veep was seeing a "file in use" dialog in Word or Excel. The veep replied that he was indeed seeing an error that read "General failure is reading Drive C" – but that was obviously someone using the handle "General Failure" to mask their identity. Lee's next question was very precise. "I asked if the error message read 'General failure is reading Drive C:'" he told On Call. The VP re-read the dialog and corrected himself, telling Lee the exact text was "General failure reading Drive C:" At this point, Lee had good news and bad news. The bad news was that the error meant the VP's disk had died. The good news was that nobody was using the handle "General Failure," so the company didn't have a miscreant rummaging around on the network. Lee arranged a support call and advised the veep that he would be getting a new disk and might even be in line for a whole new PC. Have your users misinterpreted an error message? If so, click here to send On Call an email. We can't be clearer than that – or more sincere in our desire to share your story with your fellow Reg readers. ®

Apple says that its next-gen operating system will allow users to update their weak and compromised passwords with a single tap. Upgrades coming to iOS 27, announced at Tim Cook’s last Worldwide Developers Conference (WWDC) this week, introduce a significant change to the way users manage their passwords. “Building on its ability to alert users about weak and compromised passwords, Passwords can now automatically fix these for users with just a tap,” Apple said on Monday. “Using Apple Intelligence and Safari to agentically take action on a user’s behalf, Passwords securely navigates through websites to sign in and upgrade their accounts to strong passwords.” The iGadget-maker’s existing password manager already flags passwords that are known to be included in prior data breaches, checking whether they appear in known data leaks. However, current Passwords still requires users to update affected accounts themselves and does not offer a way to change multiple compromised credentials at once. Selecting one of those alerts typically takes users to the relevant account page, where they must complete the password change manually. The new update is designed to remove much of that legwork, with iOS 27 automatically navigating supported websites and updating eligible accounts to stronger passwords after user approval. Of course, in the very brief section of the video in which the new capability was announced, the feature worked flawlessly. In practice, however, it remains to be seen how effective Passwords is at agentically navigating different websites’ login processes on behalf of users, especially if MFA is also set up on the account. And for those of you who remember a story The Register covered earlier this year about the (in)security of AI-generated passwords, fret not. Apple’s Passwords app generates solid passwords by default – strings that, according to NordPass’ online password checker, are “strong” and would take centuries to crack. Security company Irregular’s research from February looked at scenarios where users were querying LLM chatbots for password ideas, rather than looking at those generated by purpose-built password managers. Siri state of affairs As predicted by many, this year’s WWDC put Siri, now known as Siri AI, front and center as Apple looks to deliver on its promises made two years ago. It announced Apple Intelligence in 2024, but the offering has underdelivered on pretty much every count. Analysts who spoke to The Register after the event on Monday were optimistic about what they saw on the AI front, but described Apple’s ability to deliver value for developers and users on its second roll of the dice as a credibility test. The company announced a wide range of small AI-enabled upgrades coming soon to iOS 27, powered by Apple's Foundation Models, developed in collaboration with Google and its Gemini technology, in addition to the agentic password-fixing tease. Individually, these features, such as enabling users to create shortcuts or Safari extensions by prompting Apple Intelligence using natural language, and Safari’s Notify Me, which allows users to monitor specific web pages for updates, are not revolutionary. They’re also not the type of features that are poised to set the AI industry alight. But for some, winning the AI race is less about being first to market with the biggest, baddest model; it’s about using AI in the most useful way. "Rebuilt from the ground up, Apple is trying to make AI feel native, useful, and invisible across the devices people already use every day," said Francisco Jeronimo, IDC VP of client devices. "This matters because the winning AI experience for consumers will not be the loudest or most technically complex. It will be the one that understands context, respects privacy, works reliably across apps, and reduces friction without forcing users to change behaviour." Apple’s iOS 27 will launch to the wider public in the fall, while devs can get their hands on the beta version now. This won’t come with the new dedicated Siri AI app, though. You’ll have to join a waiting list for that one. ®