📰 Tech News:

German Companies Fear Their US Dependency

German companies increasingly view their reliance on US technology as a risk. However, many do not take any action.

This is shown by a recent ifo survey reported by heise. 88 percent of the companies surveyed use digital products from the US. 31 percent consider their dependency to be significant. Particularly noteworthy: about one in five companies considers their own dependency risky but still does not plan any countermeasures.

The companies cite high switching costs, lack of alternatives, and the effort of migration as reasons. At the same time, the survey shows what options are generally considered: 34 percent mention European providers, nearly 30 percent a stronger diversification. Only 19 percent rely on Open Source.

Thus, the study describes a problem that goes far beyond individual software products.

The debate about digital sovereignty is often conducted as if European companies had to replace Microsoft, AWS, or Google overnight. This is unrealistic—and distracts from the real problem.

Sovereignty does not mean autarky. It means freedom of choice.

A company is not sovereign if a switch is technically possible but economically hardly justifiable. Proprietary formats, closed interfaces, high migration costs, and deeply integrated platforms quickly turn a product decision into a structural dependency.

This is precisely why the low importance of Open Source in the survey is interesting. European providers are important. But a European headquarters alone does not prevent vendor lock-in.

Open source code, open standards, and interoperable systems can, however, create switching options and reduce dependencies. Not automatically and not for free—but structurally.

Politics also bears responsibility. ifo President Clemens Fuest calls for better framework conditions for European providers and binding procurement commitments from the public sector. This is an important point: Europe can talk about digital sovereignty for years. If administrations and companies then continue to buy almost exclusively from the established US corporations, no competitive European ecosystem will emerge.

The real warning of this survey is not that German companies are dependent on US technology.

But that they now recognize this dependency as a risk—and yet continue it.

🔗https://www.heise.de/news/Souveraenitaet-Viele-Unternehmen-sehen-riskante-US-Abhaengigkeit-tun-aber-nichts-11419703.html

Microsoft Alternative openDesk: Social Insurers Confirm Suitability for Emergencies

The German Pension Insurance and the Federal Employment Agency have tested openDesk as an emergency workplace. The result: The open-source solution is suitable for the intended use in crisis situations, as reported by heise.

Behind the test is the project “Cloud-based Communication in Crisis Situations” (CKKI). In addition to the German Pension Insurance and the Federal Employment Agency, IT service providers Bitmarck and BG-Phoenics as well as the Center for Digital Sovereignty of Public Administration (ZenDiS) are involved. The Federal Ministry for Economic Affairs and Energy funds the project.

The goal of the project is a digital emergency workplace that can be used independently of the regular IT infrastructure. This is to ensure that the participating organizations remain operational even if their primary systems are not available in a crisis situation.

The technical basis is openDesk. The open-source suite developed by ZenDiS provides applications for office work, email, calendar, project management, and video communication and is used via the browser.

A focus of the project is on the technical independence of the individual installations. The four participating organizations each operate their own openDesk instances on different cloud infrastructures. It was also tested whether the systems can communicate with each other across different cloud providers. The infrastructure partners involved include Ionos, Stackit, and T-Systems.

After the tests, the evaluation is positive: The German Pension Insurance and the Federal Employment Agency have deemed openDesk suitable as an emergency workplace.

The results of the project are also to be incorporated into the European cloud initiative 8ra. This is intended to use the insights from the German pilot project for the development of a cross-provider European cloud infrastructure.

openDesk is thus not tested as a complete replacement for the existing IT infrastructure, but as an additional work environment for situations where the regular systems are not available.

🔗https://www.heise.de/news/Microsoft-Alternative-openDesk-tauglich-fuer-den-Ernstfall-11374072.html

OLG Bamberg: Amazon’s Report Button and Recommendation Systems Violate the DSA

The Higher Regional Court of Bamberg has classified several practices on the German Amazon platform as violations of the European Digital Services Act (DSA). The now published ruling stems from a lawsuit by the Consumer Center Bavaria and concerns, among other things, recommendation systems, reporting procedures for illegal content, and personalized feeds.

A central point is the transparency of the Amazon search. Search results are sorted according to categories such as “Recommended” or “Amazon Presents.” Although Amazon lists factors that can influence this sorting on its help pages, the court finds terms like “customer actions” or “product information” too vague.

According to the OLG, users must be able to understand which factors are decisive for recommendations and how they are weighted against each other. A mere exemplary listing of general criteria is not sufficient. This is especially true for systems where the weighting of factors changes dynamically.

The option to disable personalized recommendations also does not meet the DSA requirements according to the court. Very large online platforms must offer an easily and directly accessible option for users to deactivate profiling-based recommendations.

At Amazon, this setting is within the account settings and is only accessible after logging in. The court criticizes this hurdle also because Amazon uses the browsing and search behavior of non-logged-in users for product recommendations. The option for de-personalization must therefore be easily accessible even without logging in.

Another part of the ruling concerns the reporting of potentially illegal offers. Amazon uses the phrase “Report a problem with this product.” The court finds this designation not clear enough, as users might also understand it to mean complaints, quality issues, or transport damages.

It was also criticized that users must be logged into an Amazon account to make such a report. The DSA stipulates that such reporting mechanisms must be open to individuals and organizations. Amazon’s justification of using the login to ward off spam and bots did not convince the court.

The court also saw deficits in information about algorithms, moderation tools, and internal complaint procedures. Although information can be distributed across different areas of the platform, it must be easily accessible and comprehensibly linked for users.

The court did not follow the Consumer Center in all points. For example, a compact summary of the terms and conditions does not necessarily have to be at the beginning of the rulebooks as long as it is clearly findable.

The ruling carries the file number 3 UKl 13/25 e. Due to the fundamental importance of the questions addressed, the OLG Bamberg has allowed the revision to the Federal Court of Justice.

🔗https://www.heise.de/news/Oberlandesgericht-bremst-Amazon-Meldebutton-und-Algorithmen-verstossen-gegen-DSA-11422576.html?utm_medium=Social&utm_source=LinkedIn#Echobox=1787333321-1

🚨 ALERT:

Master Key Could Have Allowed Full Access to Azure Cosmos DB Databases

Security researchers from Wiz have uncovered a critical vulnerability in Microsoft’s database service Azure Cosmos DB. The vulnerability, dubbed “CosmosEscape,” allowed the researchers to access a master key that could have provided extensive access to the databases of Azure Cosmos DB customers—including Microsoft’s own databases.

The vulnerability enabled an escape from a sandbox through specially crafted Gremlin queries. This allowed the researchers to reach a database gateway where the cross-platform master key was located.

According to Wiz, this key allowed the retrieval of the primary key of any Cosmos DB account. This would have enabled unrestricted read and write access to the respective databases. Additionally, databases could be listed across different Azure regions and filtered, among other things, by subscription or tenant IDs.

CosmosEscape was discovered on November 20, 2025. After the report, Microsoft is said to have implemented a hotfix within two days. The final correction was reportedly completed in July 2026. Microsoft has since removed the master key and introduced additional security mechanisms.

According to the security researchers, there is currently no need for action for Azure Cosmos DB customers. There is no evidence that the master key was previously exploited by attackers.

Wiz plans to present the full attack chain and further technical details on CosmosEscape at Black Hat 2026 in Las Vegas on August 6.

🔗https://www.golem.de/news/microsoft-forscher-finden-masterkey-fuer-vollzugriff-auf-azure-datenbanken-2607-211473.html

💬 LinkedIn Post of the Week:

When AI Pushes GitHub to Its Limits

GitHub was disrupted for almost eight hours last Monday. Website, Actions, Copilot, Pull Requests, and Login were affected. For many developers, this meant a standstill.

Jens Bohse addresses the outage in his post and focuses on the truly interesting aspect behind it: the speed at which AI is changing the demands on development infrastructure.

GitHub initially wanted to increase its capacities tenfold. A few months later, it was apparently clear: That is not enough. According to Bohse, the company is now planning with thirty times the capacity.

The reason also lies in the increasing use of AI agents. They produce code, commits, pull requests, and builds at a speed and volume for which existing systems were not designed. An outage at GitHub is thus more than a technical glitch. It shows how quickly AI is not only changing software development but also putting the infrastructure behind it under pressure.

The second aspect that Jens Bohse addresses is also exciting: While GitHub struggles with these scaling problems, new platforms are emerging that are attacking GitHub’s central position.

The post succinctly brings these developments together and thus very well shows the consequences AI agents already have for the infrastructure of software development.

My LinkedIn Post of the Week therefore comes from Jens Bohse.

🔗<https://www.linkedin.com/posts/je