2026-09-09
A caller phones Radio Erywan.
“Is it existent that successful Moscow, connected Red Square, they springiness retired cars?”
“True. Not successful Moscow, however, but successful St. Petersburg. Not connected Red Square, but connected Revolution Square. Not cars, but bikes. And they don’t springiness them out, but bargain them”.
RACE is simply a autochthonal macOS terminal multiplexer written successful Rust. You tin position and resize terminals freely alternatively of squeezing everything into a azygous grid: Keep a ample editor beside a mini shell, dispersed retired build logs, put the workspace astir the work, people pinch colors etc. I built it, I usage it, and I support it. Since it’s multiplexer it manages terminals and lets ammunition sessions past exertion restarts (good for improvement and hooking disconnected the work).
In action it looks for illustration this:
I besides built the website for it - https://race-term.com. Static page built pinch Bridgetown. JavaScript changes the DOM to supply interactive ocular features and that’s it. No civilization server-side exertion down it. At the submission clip (that changed recently) the only third-party JavaScript ws Cloudflare Analytics. No Google Analytics aliases advertizing search - to support it light. Served from Cloudflare, Cloudflare R2 keeps the downloads.
Then I tried advertizing for the first time.
I group up a Google Ads campaign. Spent 500$ and… Google suspended the relationship for “Malicious software”.
Unexpected summation to the characteristic list.
To beryllium precise - Google said “Malicious software” and “Compromised Site”. Sounded for illustration bullshit. Application was signed and notarized. Website was clear and had nary onslaught surface, but judge I’ll check. Zero. Nothing. Nada. Clean for illustration a whistle. So I appealed.
It rejected my appeal, told maine to taxable caller information, and suggested deleting my relationship if I had none. It besides pointed maine toward EU redress options.
It did not opportunity what was malicious, what was compromised, aliases why the grounds I supplied grounded to reside either accusation. I received instructions for appealing the decision, but nary mentation that would thief maine challenge.
I appealed, and sewage rejected.
Then I appealed, and sewage rejected.
And I appealed pinch moreover much information, and sewage rejected.
And again, and sewage blocked for a week.
And again…
We person completed a afloat information reappraisal of the RACE website, download infrastructure, JavaScript assets, and distributed macOS application.
Security verification
- Google Safe Browsing: nary issues reported for the distributed DMG:
https://transparencyreport.google.com/safe-browsing/search?url=https:%2F%2Fdownloads.race-term.com%2FRACE.dmg&hl=en - VirusTotal: the distributed DMG/binary is clean:
https://www.virustotal.com/gui/file/84d082f6a5d3ab75b30e532bf60b406ce12ecc3550bc3f2c6904f34d08ba5e9f?nocache=1 - The DMG and exertion signatures were independently verified and recovered valid and clean.
- All JavaScript root files and generated bundles utilized by the website were reviewed. Bundle outputs were analyzed and nary malicious, injected, obfuscated, aliases unexpected codification was found.
- Google Search Console — race-term.com: nary information issues reported:
https://search.google.com/search-console/security-issues?resource_id=sc-domain%3Arace-term.com - Google Search Console — downloads.race-term.com: nary information issues reported:
https://search.google.com/search-console/security-issues?resource_id=sc-domain%3Adownloads.race-term.com
Application behavior
RACE is simply a autochthonal exertion written successful Rust. It is simply a terminal multiplexer, truthful by creation it launches and manages terminal processes successful the background.
This subprocess-management behaviour is an basal portion of the application’s functionality and whitethorn lucifer behaviour sometimes associated pinch security-sensitive software, but it is neither hidden nor malicious.
The process-multiplexing system is documented successful the application. Users tin besides configure RACE to usage dtach arsenic an replacement multiplexer. This behaviour and the applicable configuration are disclosed successful the application’s About/configuration documentation.
The exertion does not instal malware, inject codification into different applications, modify browser behavior, aliases effort to conceal its process activity.
Request for review
We person investigated each plausible causes of the policy/security flag, verified the website and distributed exertion utilizing some Google and independent information tools, and recovered nary information issue.
We truthful judge the suspension whitethorn beryllium the consequence of a mendacious positive, perchance related to the morganatic subprocess-management behaviour inherent to a terminal multiplexer.
Please execute a manual re-review of the account, website, and exertion based connected the grounds above.
Checklist
But it’s not for illustration I conscionable responded. I checked!
1. Google Safe Browsing
I checked some race-term.com and downloads.race-term.com. Both reported “No unsafe contented found”. The screenshots show the position updated connected 9 September 2026.
This establishes what Safe Browsing reported for those addresses. It does not found what Google Ads detected, aliases whether the 2 systems usage the aforesaid criteria.
2. Google Search Console
I opened the Security Issues study for each domain separately. Both reported “No issues detected”.
There was nary listed infected page, malicious download, aliases injected assets to investigate. Again, this is simply a consequence from Search Console, not a clearance certificate from Google Ads.
3. The File
Maybe thing sewage into the file? Worth checking the file, right? And truthful I did. Of people it came retired clean! The nosy point is that moreover Google’s scan identifies NO MALWARE inside.
4. Signatures and website code
And truthful I checked:
- File signatures
- Notarization status
- Raw JavaScript output
- Bundled JavaScript output (who knows possibly something’s successful the bundler?!)
- Cloudflare logs (maybe Google bounced of immoderate anti-LLM defender aliases captcha)
- Accessibility pinch different User Agents
Nothing. Nothing. Nothing.
5. Persistent terminal processes
There is 1 point though.
RACE deliberately starts and manages inheritance ammunition processes. Its configuration documents 3 persistence backends: its autochthonal PTY host, outer dtach, aliases nary persistence.
Ok, truthful I thought - possibly that’s the case. That you tin commencement app, and it stays behind. So I made type 1.0.39 that makes a hacky cleanup aft exertion is deleted. Submitted it and do you cognize the results?
(Note: hackiness is out, correct now personification is being asked astir it, though it’s fucking stupid from UX perspective)
What now?
Who knows. That roadworthy mightiness beryllium retired forever.
What is the astir enraging successful the full business is Catch 22 I’m in:
No thought what I tin do now, I’ll entreaty until oblivion, …or possibly I’ll effort EU tribunal case. Cause it seems for illustration that’s the only roadworthy forward.
Radio Erywan astatine slightest supplied the corrections.
English (US) · 
Indonesian (ID) · 
