jsr

chasing badness

Public Key

npub1vz03sm9qy0t93s87qx2hq3e0t9t9ezlpmstrk92pltyajz4yazhshfttwj

Profile Code

nprofile1qqsxp8ccdjsz84jccrlqr9tsguh4j4ju30sac93mz4ql4jwep2jw3tcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduq36amnwvaz7tmwdaehgu3dwp6kytnhv4kxcmmjv3jhytnwv46qqug9rn

Publishing to

relay.damus.io

nostr-pub.wellorder.net

premium.primal.net

Author Public Key

npub1vz03sm9qy0t93s87qx2hq3e0t9t9ezlpmstrk92pltyajz4yazhshfttwj

Show more details

Last Notes

2025-06-21 09:45:39

- reply

Computer vision & HUDs are cool. AI vision is fascinating.
But this is a trojan horse for megacorp to get into *all* your interactions.
Friends don't let friends bring Zuck in a backpack on their adventures.
https://blossom.primal.net/cc9a7e6cda3ee22b3835c484f56376983e60f171b49b29c723711c11db068caa.png

2025-06-21 09:43:00

- reply

Or, wear these #Dorkleys yourself & become an NPC constantly asking your eyewear 'hey meta is this real?'
https://blossom.primal.net/5fd0a98bd9541203b6b2854aa0e9cde850e6e4a46fb3f09bf1b7c43a80eb1a5c.png

2025-06-13 20:52:42

Headline that I saw...
https://blossom.primal.net/0dba01b8ddf305d71f78918a555bd1bd6d2715e087b8f6a5ce6fdaf6a7cf39cf.png
This is not something I was tracking.
https://blossom.primal.net/6201ecf0be2855126a7cd4d55defcf0388b1dc2da83beaf803365c1b7817444a.png
Source: https://www.thefp.com/p/im-the-cto-of-palantir-today-i-join

2025-06-13 00:47:17

Pentagon pizza place indicators are undefeated.
Israel just launched an air attack. https://blossom.primal.net/86ba7e4c3c67493360439d89a79ee1ae5d2b5ab6b6bdbe5b25239742fefa9f2b.png Source: NYTimes.
#nevent1q…vctq

2025-06-11 23:07:08

Pizza places near Pentagon showing a *lot* of activity.
That favorite conflict indicator coupled with sudden cascade reports of US embassy evacuations & non essential personnel voluntary departures + rhetorical change in statements about talks with Iran... it's enough to make a lot of people start speculating about threats of strikes into Iran.
Disclaimer: Me? I'm not even an armchair geopolitical expert. And I'm certainly not smart enough to know if this is just signaling, or whether something happens soon. Or a bit later.
https://blossom.primal.net/c9ad2618f2217a17dcddacc0c3341a61dbe2c9346c1231f3003e6864e7a34588.png https://blossom.primal.net/afc0fcaefd87949ca766578a96872e99d1cfd6df1a2b22ac637a7cb76fd6cd39.png

2025-06-11 22:02:15

- reply

@grok what does @nprofile…rj62 mean?

2025-06-11 21:59:49

"@grok just tell me what to think, feel and say about this"

2025-06-10 17:40:28

- reply

Tried and failed to zap. Very good additional point

2025-06-10 14:14:29

- reply

Primo analogy that instantly nested in my brain.

2025-06-10 14:07:28

- reply

Disagree with the sentiment. The inflammation-depression axis is incredibly interesting & new. It needs to be more widely understood outside of the cutting edge of research.
Review articles like this also serve a pretty important role, especially in the context of efforts to develop new diagnostic criteria. As such, important for general public to read them.

2025-06-10 13:29:30

Understanding grows when scientific knowledge is shared.
Yet in 2025 some journals still gatekeep important research.
Like this review of links between depression & inflammation.
$35 if you aren't at an institution with a subscription.
Imagine if a library that charged $35 to read a book?
https://blossom.primal.net/e464889c5b49019eace6432b760bd6f66a2edf31539826f1a8f765a133d8bfae.png
That's enough friction to keep the knowledge from most of the globe.
Every time I encounter knowledge gatekeeping in a health related journal I wince.
I wonder if the American Journal of Psychiatry has considered the costs to the field, and our global mental health, of staying closed?
https://blossom.primal.net/8a6d134cfeab32c6434b8dbc7982ccc20f4a06ba142b6183d5f792fe8b3f6b0f.png
The thing is, I can personally read these articles thanks to my institutional affiliation.
But the momentary friction as I cross through the paywall reminds me that most people can't.
The article: https://psychiatryonline.org/doi/10.1176/appi.ajp.20250289

2025-06-07 23:15:16

- reply

Credit to our team, collaborators & the victims that bravely come forwards to share the truth.

2025-06-07 22:51:01

- reply

I think there's a lot of value in using a more security & privacy focused OS like #GrapheneOS. For those not interested in going that far, Lockdown Mode on iOS (& Advanced Protection Mode coming soon in Android 16) both look like interesting choices to raise the cost-to-hack.
That said, I'm not sure that any operating system is going to totally prevent this category of attack.

2025-06-07 22:49:12

- reply

Yep, me & my colleague cowrote that paper 😉
You're right, the tech has gotten smarter. The 2016 cases for example were 1-click attacks. More recently we've seen most of the players doing 0-click attacks. Which makes sense if you've got the resources for it.
And Paragon, for example, is a more sophisticated animal. Despite this, we continue actively tracking mercenary spyware including Pegasus. And Paragon's Graphite and some others..

2025-06-07 12:05:59

🎥FRESH TALK DROP: Your phone, the spy.
In the fight against spyware like Pegasus, your phone is the frontline.
Last week at the Oslo Freedom Forum https://blossom.primal.net/4dc930b72c717f0123891cb0195a1a86086baab8ebfdccbf8b78b1b5316a9551.mp4
Topics:
❌The dictators repression toolkit
❌How mercenary spyware is used to spread fear around the globe
❌Zero click vs 1 click attacks
❌What works in the fight to pump the brakes on spyware proliferation
BONUS:
✅What you can do right now to make yourself harder to hack
Full talk:
https://youtu.be/qknOIafYODs?t=63

2025-06-06 20:28:06

- reply

Interesting observation here. Speaks to some fundamental limitations in the desire instantly to convert anyone to anything.

2025-06-05 19:49:39

- reply

This kind of thoughtful answer is why I decided to #asknostr first. Thank you @nprofile…zy8w

2025-06-05 19:48:42

- reply

Will look at both, thank you

2025-06-04 21:01:29

NEW: accused mastermind of French crypto kidnappings arrested in Morocco.
24-yo Badiss Mohamed Amide Bajjou allegedly orchestrated the kidnappings & assaults from abroad.
https://blossom.primal.net/b8eb69823492b37acbb7a86fe1268760540246ea425ea069e81752b78fd3d34c.png
Including severing Ledger founder David Balland's finger.
Authorities are probing possible links to additional cases.
https://blossom.primal.net/4655a25fc242c70c4ba936b223bdd5e7fe0f2dcd7f5fc4126dfc01bb611cec1c.png
This dynamic of remotely-masterminded attacks is terrifying. Nothing about these attacks requires super special skills, and the sheer ease of moving the assets once the wrench attack has happened is likely to attract more criminal groups.
https://blossom.primal.net/c6bc85410271025c79260328f797c0925c4f6281e773f148bbb0ef0eb181f9a6.png
I still think we're in the earliest days of these. Plenty of #OPSEC lessons and complexities to start thinking about here.
Also, almost certainly the case that post- #Coinbase breach we will see more of these attacks.
Read the news story: https://www.lemonde.fr/en/pixels/article/2025/06/04/suspected-mastermind-of-french-crypto-kidnappings-arrested-in-morocco_6742008_13.html

2025-06-04 19:21:38

Pegasus-maker NSO group has been getting bodyslammed.
So instead of taking accountability or changing their ways...
They are refreshing their brand as "NSO: Safer Society"
Pure dystopian stuff here.
https://blossom.primal.net/9000d78e66faedaff7bd6abae5c37b0724e5d8f7202190480feeaa58d410aff6.png

2025-06-04 11:44:08

Has anyone asked DeepSeek what happened in Beijing on today's date in1989?

2025-06-04 11:37:57

- reply

What happened in China was morally indefensible oppression.
Students that stood up for the truth and basic freedoms paid with their lives.
Their memories should be celebrated. Not the government that chose to perpetuate violence instead of dialogue.

2025-06-04 11:14:18

- reply

My god

2025-06-04 10:41:23

Do you know what the date is today?
Today is the anniversary of the Tiananmen square massacre.
Take a moment to watch this video.
https://blossom.primal.net/3b513c2c5774a2150d240931b83db5d13625fcd789d7f5c8924acc18da1275ce.mp4
Dictators hope that if they make us afraid to speak the truth for long enough... we'll forget it.
And the next generation will never learn.
This is how history is erased.
A Day to Remember, 2005, by Liu Wei
Full: https://vimeo.com/44078865

2025-06-04 09:29:22

- reply

This is exceptionally cool. More power to the whole crew @nprofile…5kd8 @nprofile…mess @nprofile…nucx & @nprofile…h36r

2025-06-03 18:36:01

Company: we use advanced fraud detection to prevent you from using disposable addresses & VPNs to protect your privacy.
Also company: we got breached because we treat your privacy as disposable.

2025-06-03 18:16:06

- reply

Thoughtful comment

2025-06-03 14:56:01

Horrid. Big structural mistake here.
Also, if you were impacted: I'm so sorry.
We need to expand the conversation to think through these increasingly common attacks.
No more skipping physical OPSEC leg day.
#nevent1q…v7a9

2025-06-03 10:44:39

- reply

You might be right. And an even bigger argument for why it makes sense to pay attention to the network effects that can be harnessed, minus the VC vibes..

2025-06-03 10:10:13

VERY interesting research on how academic twitter migrated to #Bluesky.
Interesting topline takeaways for growing #nostr. No rocket science that's not been said before, but it's nice to have some data:
1- External shocks are key. Capitalize on them. >15% of transitions explained this way. Think geopolitical events, outages, Musk making a big disliked policy change etc.
https://blossom.primal.net/bf7b42d4e5dfb1bfd81d36cd7bb4aab961c2d4c7af41d0e9298f61af62af9da8.png
2- Audiences move from incumbent platforms following influential voices that they follow. Focus on onboarding these influential voices. This is more impactful than just trying to bring the whole audience first.
https://blossom.primal.net/50d77aaffce370c49f1cc853471560ce49c8e560cb5551bf79168704335ed781.png
This dynamic can build contagion. Find ways to more publicly highlight when influential accounts join.
And make it super easy for Nostr users to use clients to reconstruct followees & social graphs from incumbent platform. Trick will be to do this in a privacy respecting way.
(sidenote: that's way the follow packs were such a good idea. But we need much more of this)
(note: influential voices may experience a period of 'where's my audience?' So it's key to find ways to get the transitioning user from that to the reconstruction of their network. )
3- Multiple peers transitioning is key. Having local clusters develop is important (& probably helps with the dry period before an audience is rebuilt.)
Interesting nuance: transition rates to #bluesky were 25-30% in fields like arts/social sciences, but about half that in medical / physical sciences / engineering. Possible predictors include baseline political engagement & political values expressed.
https://blossom.primal.net/bf60153b7d7a9a282b632d2f120a9883391a7a902b577f12abdfec90d5c93942.png
This has an implication for Nostr: focus messaging on Nostr features that may align with people in incumbent platforms. There has to be desire.
Paper "Why Academics Are Leaving Twitter for Bluesky" https://arxiv.org/pdf/2505.24801

2025-06-02 17:11:35

Now more than ever it is critical to recognize where you've outsourced your cognition.
And whose hidden assumptions your mental economy is now running on.

2025-05-21 19:34:56

NEW: Senator Wyden just exposed which companies keep silent about government surveillance.
No = doesn't respect Americans' privacy rights.
Choose accordingly.
https://blossom.primal.net/d33cb9659ff0dd0ff3e2162ec3c9f61454418e48a2ba77ad004c7576dbc262d7.png
But Wyden didn't stop there. https://blossom.primal.net/d883f77fd240365c07b3ac7162a213d8b7ebbe2d8f1b6063243d1bbfba36a0a0.png
He highlighted troubling evidence that when government-ordered surveillance of Senators took place, companies failed to notify Senators.
https://blossom.primal.net/a118f1f62f54b3a414e33149197001de409e75adeba7b3632d514cebabc6c5d1.png
This is a bad, scary look for these companies. And it drives home the fact that Americans are often running blind when it comes to potential surveillance overreach.
Sources:
Wyden Letter to colleagues: https://www.wyden.senate.gov/imo/media/doc/wyden_dear_colleague_on_senate_cyber_and_surveillance_surveillancepdf.pdf
Wyden press release: https://www.wyden.senate.gov/news/press-releases/wyden-reveals-which-phone-companies-protect-privacy-by-telling-customers-about-government-surveillance

2025-05-20 12:25:30

Privacy advocates must to win every fight to keep your data protected.
Data brokers need to win just once.

2025-05-16 20:27:14

NEW: #Google's #Android 16 to feature optional high security mode. Cool.
Advanced Protection has a bunch of requested features that address the kinds of threats we worry about.
https://blossom.primal.net/f19388ad4282b6473df62c60cedd2c633ff3e3aba32cae33d8b4f03e1fb6e265.png
It's the kind of 'turn this one thing on if you face elevated risk' that we've been asking for from Google.
And likely reflects some learning after Google watched #Apple's Lockdown Mode play out.
Here are some thoughts:
SOME FEATURES IM EXCITED FOR:
The Intrusion Logging feature is interesting & is going to impose substantial cost on attackers trying to hide evidence of exploitation. Logs get e2ee encrypted into the cloud. This one is spicy.
The Offline Lock, Inactivity Reboot & USB protection will frustrate non-consensual attempts to physically grab device data.
Memory Tagging Extension is going to make a lot of attack & exploitation categories harder.
2G Network Protection & disabling Auto-connect to insecure networks are going to address categories of threat from things like IMSI catchers & hostile WiFi.
FEATURES IM ..MORE CAUTIOUSLY CURIOUS ABOUT
Spam & Scam detection: Google messages feature that suggests message content awareness and some kind of scanning.
https://blossom.primal.net/5b3a85ad8c678393c5e8c03f88902e25a994899776c15dc8a3517e2752235a17.png
Scam detection for Phone by Google is interesting & coming later. The way it is described suggests phone conversation awareness. This also addresses a different category of threat than the stuff above. I can see it addressing a whole category of bad things that regular users (& high risk ones too!) face. Will be curious how privacy is addressed or if this done purely locally.
FRICTION POINTS?
I see Google thinking some of thisC through, but I'm going to add a potential concern: what will users do when they encounter friction? Will they turn this off & forget to re-enable?
We've seen users turn off iOS Lockdown Mode when they run into friction for specific websites or, say, legacy WiFi.
They then forget to turn it back on. And stay vulnerable.
Bottom line: users disabling Apple's Lockdown Mode for a temporary thing & leaving it off because they forget to turn it on happens a lot. This is a serious % of users in my experience... And should be factored into design decisions for similar modes.
GIVE US A SNOOZE BUTTON
I feel like a good balance is a 'snooze button' or equivalent so that users can disable all/some features for a brief few minute period to do something they need to do, and then auto re-enable.
Yes, during that brief period there is vulnerability (and a potential social engineering target), but if the trade off is that the user likely just turns the whole thing off and forgets it..that is worse.
HIGH SECURITY & HIGH PARANOIA USERS
Some users, esp. those that migrated to security & privacy-focused Android distros because of because of the absence of such a feature are clear candidates for it...
But they may also voice privacy concerns around some of the screening features. And about the fact that the phone would need to be re-googled (think:Graphene which confers a lot of privacy by stripping out most google features)
Clear communication from the Google Security / Android team will be key here.
TAKEAWAYS
I'm excited to see how #Android Advanced Protection plays with high risk users' experiences.
I'm also super curious whether the spam/scam detection features may also be helpful to more vulnerable users (think: aging seniors)...
Google's blog: https://security.googleblog.com/2025/05/advanced-protection-mobile-devices.html

2025-05-15 20:16:12

I just tried the new #Primal article editor.
It's awesome.
https://primal.net/jsr/the-cognitive-style-of-long-form-notes https://blossom.primal.net/795405498fe4a0359b4aac1b95c026e4518c4e057b00f2e87b425fa8acc4f318.png

2025-05-11 22:21:38

- reply

The reason the ad doesn't explain what the device does...
Is because the real purpose is a massive biometric data grab.
Which is uncomfortable and bad.

2025-05-11 22:18:47

Terrible ad from a cynical man trying to steal your privacy.
https://blossom.primal.net/3a28369f9a5c6ee2f5c7536473b0bafb2361c77e754c298d3f40203e55c21bda.mp4
I've talked about the Orb Mini before:
#nevent1q…6758

2025-05-06 23:25:36

- reply

Coda: WhatsApp acknowledges long road to collecting damages, but are stating their intention to donate to help orgs that assist spyware victims.
https://blossom.primal.net/98fbd28dde36a2e26551d08d601f731cab39415055fe0626da4522ff32f43812.png
Source: https://about.fb.com/news/2025/05/winning-the-fight-against-spyware-merchant-nso/

2025-05-06 23:19:43

BREAKING: jury awards massive $167 million in punitive damages against spyware company NSO Group.
https://blossom.primal.net/b969407c98a4b0e39a6cb3c7fd4a5dcbd9819babc71fb7f62e623690d825de15.png
It turns out that the regular people on a jury think it is evil when you help dictators hack dissidents.
After years of every trick & delay tactic it only took a California jury ONE DAY of deliberation to get this Monsanto-scale verdict. Precedent-setting win against notorious #Pegasus spyware maker.
BACKSTORY:
Rewind to 2019. About this time (April-May) #WhatsApp catches NSO Group hacking its users with #Pegasus.
They investigated.
https://blossom.primal.net/8f50f124ebff031a6a37b33270aacce1b5a3ff5e26ef77f53a039a56e38c7a90.png
We at Citizen Lab helped to investigate the targets & get in touch with the activists journalists & civil society members that were targeted
https://blossom.primal.net/8aeb34cb2052d2af92bcd34e4443525c45648eb9224cadc70d1ec8d760afe393.png
We identified at least 100. And got in touch. It was a tremendous push of sleepless days. But it made it so clear just how much harm was being done.
Then, In October 2019 WhatsApp sued.
Prior to the lawsuit, NSO had acted the playground bully.
Targeting victims that dared speak up & researchers like us.
Suddenly, the bully wasn't so surefooted. Like the scene in a high school movie where the cousin shows up in the beat up car & collars the bully.
You might not remember, but in 2019 no country had sanctioned NSO Group... No parliamentary hearings, no hearings in congress, no serious investigations.
For years, WhatsApp's lawsuit helped carry momentum & showed governments that their tech sectors were in the crosshairs from mercenary spyware too...
Credit due to Meta & WhatsApp leadership on this one, they stuck the fight out & carried it across the finish line.
NOTIFICATIONS MATTER
WhatsApp's choice to notify targets was also hugely consequential.
A lot of cases were first surfaced from these notifications.
With dissidents around the world suddenly learning that dictators were snooping in their phones...with NSO Group's help.
A SIDEBAR: HARASSING RESEARCHERS
One of NSO's many tactics was to leverage the case to badger me & us Citizen Lab researchers to try and extract information.
https://blossom.primal.net/3e4a3bd8248a954b919f660bdefc12ca76178f37d2eb7250ce17b0bdffaddab3.png
It never worked, but it laid bare the tactics that these firms prefer...instead of coming clean.
ROLE OF CIVIL SOCIETY
Ultimately, we wouldn't be here without civil society investigations of mercenary spyware... and alarm raising.
And victims choosing to come forwads.
Thankfully today there's a whole accountability ecosystem growing around this work.
Dozens of orgs engaging.
Numbers are growing.
IS THERE GONNA BE IMPACT? YES
NSO Group emerges from the trial severely damaged.
The damages ($167,254,000 punitive, $440K+ compensatory) is big enough to make your eyes water.
NSO'S BUSINESS IS NOW ALL OVER THE NET
The case is also a blow to NSO's secrecy, with their business splashed all over a courtroom.
https://blossom.primal.net/3d9bfc037d31d95cc052430e8cdd8570c36506388de63a5f08cd185ffe6f3c54.png
WhatsApp just published NSO's depositions, exposing an unprecedented amount of info on a spyware company's operations:
✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Eshkar-Transcrips_Case-4-19-cv-07123-PJH.pdf
✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Gil-Transcrips_Case-4-19-cv-07123-PJH.pdf
✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Shohat-Transcrips_Case-4-19-cv-07123-PJH.pdf
✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Gazneli-Transcrips_Case-4-19-cv-07123-PJH.pdf
This will scare customers. And investors. And other companies that do the same thing. Good.
MY VIEW:
Watching a jury of regular citizens see right through NSO's mendacity & hypocrisy...and to the need to protect privacy is amazing.
Gives me hope.
Despite all the fancy lawyering & lobbying, people know that this kind of privacy invasion is wrong.
Read more:
They Exposed an Israeli Spyware Firm. Now the Company Is Badgering Them in Court. https://theintercept.com/2024/05/06/pegasus-nso-group-israeli-spyware-citizen-lab/
Spyware maker NSO ordered to pay $167 million for hacking WhatsApp
https://www.washingtonpost.com/technology/2025/05/06/nso-pegasus-whatsapp-damages/
NSO Group must pay more than $167 million in damages to WhatsApp for spyware campaign https://techcrunch.com/2025/05/06/nso-group-must-pay-more-than-167-million-in-damages-to-whatsapp-for-spyware-campaign/

2025-05-05 10:24:49

#Skype shuts down TODAY.
Here's the link to download your contacts, chats etc:
secure.skype.com/en/data-export
https://blossom.primal.net/fdc98c0d7f38405d38f4714ab7084b18ff46b62252d4bf5a6e208366bf04437f.png

2025-05-03 21:08:00

Age verification is often a trojan horse for broader surveillance demands.

2025-05-02 16:06:11

AI friends consoling me because my cat bonded to the robot vacuum & ignores me.
https://blossom.primal.net/0eb9a07bc096d7a790a469b26ff5f0c213e2518e56710533e8d4b8bcb0806ce6.png

2025-05-02 15:49:28

- reply

A privacy invasion in search of a use case.

2025-05-01 12:32:17

Any time you see a name like 'Tools for Humanity' you should slow down and scrutinize.
Especially when paired with AI hype.
The level of documented exploitation around the WorldCoin project is wild.
Everything @nprofile…cms0 said x1000.
https://blossom.primal.net/1a809ee53b3740691e66ba6be67084648ff4a0ca232028d2a4ec4c8952b434e0.png
Now the company wants more data.
https://blossom.primal.net/133bc1022f0bc76a5544028188cdc1da99c3521d473623e529afa39e88a55c41.png
Exploitation was baked right in from the earliest days of this hype train. https://blossom.primal.net/ae2b4dd3b61c4d6ce1f160470569c1eae36eb2af1635bf048a9ac8df26f47d1a.png
Sources;
-https://www.dlnews.com/articles/people-culture/how-worldcoin-crypto-biz-in-berlin-exploded-in-fistfights/ -https://nation.africa/kenya/news/kenyans-scanning-their-eyeballs-worldcoin-cryptocurrency-tokens-4319600
-https://www.technologyreview.com/2022/04/06/1048981/worldcoin-cryptocurrency-biometrics-web3/
#nevent1q…8h7w

2025-05-01 11:49:15

Friends don't let friends get their eyeballs scanned to buy a coffee.
This portable dystopia machine is Tools for Humanity's latest effort to live up to their Orwellian name.
https://blossom.primal.net/7d3f813ec8e8f88e1a8a65895687a43d772b2d908e88b1e69c79e84b2110f578.png
Connoisseurs of the AI-will-end-humanity marketing hype train of a few years ago should find plenty to appreciate in an eyeball scanner framed as as a 'helpful' tool to distinguish between AI agents & humans.
Or is it for that? Or maybe point of sale? Or nebulous 'verification?'
The only clear thing? This device starts from a point of biometric #privacy invasion.
https://blossom.primal.net/f157bbd63933c1cbe87afc9af071afb975504950e1cf151d5e1688afcf47cd21.png
It sure looks to me like another effort by the company Sam Altman founded to make a global data-grab.
https://blossom.primal.net/8cf71cc4ea27e87adbbe93081213e0f6bae366791e92896eaacd60702371ee08.png
Just say no.
https://techcrunch.com/2025/04/30/sam-altmans-world-unveils-a-mobile-verification-device/

2025-04-30 13:50:17

Note deletion requests! This will be valuable!
Great work @nprofile…mdf3 team keeping up the momentum on new & desired features.
#nevent1q…98rc

2025-04-29 20:16:47

- reply

Amazing.

2025-04-29 19:52:34

- reply

Part of what makes Nostr so special.
No other community comes close to this much experimental *building*

2025-04-29 19:49:27

GET IT: Best of #privacy & #security follow pack.
Follow em all:
https://following.space/d/3boa4ixmmv7h
Built on @nprofile…h36r 's magnificent community gift: Following

2025-04-29 19:40:03

Starter packs of people worth following.
You need em.
Nostr needs em.
Huge props to @nprofile…h36r for again building a thing that needed to happen.
Now, how do we get support built natively into clients?
#nevent1q…ezqz

2025-04-29 19:36:50

- reply

Truth. Also, they had better backup apps I think ;)

2025-04-29 13:39:25

- reply

Fair. Plenty of ick.
But also, plenty of physical/mineral sunscreens that do a fine job and won't tweak your endocrine system.

2025-04-29 12:14:37

Use sunscreen. Get enough fiber. Do regular backups.

2025-04-28 18:22:26

- reply

That's super interesting. I had no idea. Absolutely love this kind of history.

2025-04-28 17:37:35

NEW INVESTIGATION: Uyghurs far from China's borders are being targeted.
Attackers impersonated legit software developers & contacted the targets asking for testing help on a language app.
Then they sent a trojan.
Let's talk about why this was clever.
https://blossom.primal.net/c172136b784bbb1559f0ca8345bc1b1072a1ff72c8f03e2432775a5353097b07.png
TECHNICAL SOPHISTICATION? NAH.
Technical sophistication of this attack was...meh.
https://blossom.primal.net/6a9e740d311bce1d2afd66ef7390ed0b109f84d4797f1c64be2a9efd4b73fb28.png
But that's not where the attackers focused.
INTELLIGENCE-DRIVEN? YAH.
They spent their effort carefully crafting credible bait that matched what they knew about their targets:
Trojanizing a legit Uyghur language app was a clever, cynical move.👇
Many marginalized communities struggle with getting fonts & dictionaries to capture their language.
https://blossom.primal.net/a2287b43d725e1ff5a05d813c251aa12a3e5698ac0a5c83d0a4ca2b13487159f.png
And developer talent is very welcome.
With a lure that credible you don't need to burn your most sophisticated exploits.
Good news in this case: Gmail spotted & blunted the attacks which were only found whey my colleagues worked with vigilant targets to screen for them.
But the theme of China-nexus hacking groups being economical about exposing technical methods (just using minimum necessary stuff) while drawing from (presumably) vast amounts of intelligence and understanding of their targets to craft effective social engineering is something we at the Citizen Lab have tracked for decades.
READ THE FULL REPORT:
By my talented colleagues: https://citizenlab.ca/2025/04/uyghur-language-software-hijacked-to-deliver-malware/

2025-04-28 13:55:41

- reply

It speaks to an information space that is absolutely ahistorical.
And deliberately delights in the frisson of productizing 20th century scifi machine villainy.

2025-04-28 11:24:41

OK :)
#nevent1q…3qnu

2025-04-28 10:03:28

Fear is dictatorship glue.
You can't imprison everyone with a dissenting thought.
Or inconvenient factual observation.
But fear teaches self censorship. And is a scalable system of control.
The challenge, of course, is to keep the fear going.
And push it all the way down into private conversations.
In the 20th century, such fear required massive human investment. Informants... model punishments...information control. All on a linear scale.
And there was a post-cold war school of thought that said: once everyone is connected, these systems won't work.
But tech isn't, by nature, an a dictatorship antidote. It can equally be an expedient. Just ask China.
In the past 20 years the government has empirically developed technologies & private sector partnerships for scaling fear and self censorship to north of 1.4 billion ppl. Log scale.
Out here in the rest of the world take a look around.
The major underpinnings of our online & financial behavior have comprehensive person-tracking surveillance and information-shaping built right in... primarily to sell us even more things.
But it is the shortest possible distance from that to a totalizing system of government surveillance. Punishment. And information control.
We all carry informants in our pockets. Ready to snitch on us, shape what we feel, and implement punishments.
This is a tremendously inviting system for governments with the instincts to grab these levers.
Increasingly, they are doing just that.
Pictured: Stasi interrogation rooms.
https://blossom.primal.net/020478322d5622f0ed497c35fafe1b7cb286af99cd645664d7f5faa0cd0f71b7.png
Image source: https://hyperallergic.com/151019/mundane-horror-in-abandoned-stasi-spaces/

2025-04-25 14:38:55

- reply

Yes. A core challenge with advertising & behavior shaping = understanding how people really *feel* exposure to different content.
Everything is a somewhat distant proxy.
This would be an excellent way to get closer.. and start modeling and leveraging it.

2025-04-25 13:03:27

- reply

Yes.

2025-04-25 12:51:46

2027: we can't wait to show our advertising partners how we deliver behavior shaping across whole lives.
this is a surprisingly great feature, imo.
https://blossom.primal.net/9643f6078a67118e252c3882fd9cf08a3dce075467075a1fb41a989a64eae41e.png

2025-04-25 11:23:28

And it is no coincidence.
https://blossom.primal.net/97e44350fcad30efb7fcf6e301f1724ccdd02d71940430022663813feb311aa2.png
#nevent1q…453f

2025-04-24 10:46:05

Government censorship has come to #Bluesky.
https://m.primal.net/QbYz.png
LATEST:
On demands from the Turkish government, Bluesky restricted access to 72 accounts per a report from a Turkish NGO.
https://m.primal.net/QbXO.png
DETAIL:
Accounts are restricted for users in Turkey.
Accounts aren't banned from Bluesky's AT Protocol relays etc, but access is moderated at the official client level through geography-specific labels.
https://m.primal.net/QbXg.png
WORKAROUNDS?
Realistically impacted accounts are no longer visible to the majority of Bluesky users (most aren't on 3rd party clients) in Turkey.
However, since 3rd party client apps for the AT Protocol aren't forced to use geography-specific labels, they an still be used to view the content.
In theory, official client + VPN would also result in seeing the accounts.
LOOKING AT SOME DATA:
Bluesky has been publishing transparency reporting about legal & government requests. The most recent report covers 2024 and shows a relatively modest number of takedown requests, but about 50% response by Bluesky.
https://m.primal.net/QbYR.png
Unfortunately, the company doesn't differentiate between legal demands in civil litigation and *government* demands. This makes it hard to get a clear picture.
https://m.primal.net/QbYr.png
I hope Bluesky segments out these very different kinds of pressure in 2025 reporting so we can get a better sense of what's happening.
BIG PICTURE:
Looking ahead, governments are probing for new ways to enforce content restrictions. These are early days for Bluesky and it is likely that a lot more requests like this will be inbound as users head there to try and avoid the well-greased censorship machinery on legacy platforms like X.
Recommended reading & Sources:
Super-helpful-to-me TechCrunch article: https://techcrunch.com/2025/04/23/government-censorship-comes-to-bluesky-but-not-its-third-party-apps-yet/
Mastodon post confirming blocking with testing : https://mastodon.online/@mastodonmigration/114348331162291326
Bluesky post with the notification email screenshot: https://bsky.app/profile/aliskorkut.com/post/3lmul5pt34c2b
Bluesky 2024 Moderation Report: https://bsky.social/about/blog/01-17-2025-moderation-2024
Bluesky post describing geography-specific labels as a content-removal technique: https://bsky.social/about/blog/09-18-2024-trust-safety-update

2025-04-23 16:17:39

They Criticized Musk on X. Then Their Reach Collapsed.
https://m.primal.net/Qagt.png
Graphs from this story are stark.
https://m.primal.net/QahA.png
Link: https://www.nytimes.com/interactive/2025/04/23/business/elon-musk-x-suppression-laura-loomer.html

2025-04-23 12:25:58

- reply

3/ Here's the thing: there's a global market for trustworthy privacy-respecting apps.
The secure messaging market alone is worth billions & growing.
If European leaders can move past the un-imaginative anti-encryption myopia...it is a natural place to incubate & innovate these industries.

2025-04-23 12:21:59

- reply

2/ Today, our most intimate worlds and thoughts pass through our phones.
States forcing their way into these interactions for every citizen is the equivalent of putting a police camera and a microphone between everyones' pillows.
Then asking us to trust they'll will never look...

2025-04-23 10:55:59

https://m.primal.net/QaSB.png
Maybe we can all 'live without' private messaging?
Pay attention.
Denmark is set to take over the rotating EU Council presidency.
And is sending signals that they want to go after encryption.
Backdoors end badly.
Demanding backdoors isn't just surest way to chase away innovation...it's collective punishment for security services' own failures to adapt.
And the history of democracies is littered with states abusing secret surveillance powers to undermine core values.
Article: https://www.politico.eu/article/encryption-crime-denmark-peter-hummelgaard-europe-privacy/

2025-04-20 11:20:33

- reply

Yes. Whether by design or side effect, the trend is all in the same direction.

2025-04-20 11:19:42

- reply

Right on. So many of our contacts with technology today are with systems that are built from a place of disrespect & distain for autonomy & human agency.

2025-04-20 11:16:47

- reply

Slipping a pinch of *algorithmic opium* into every user experience disrespects human agency.
Building better means you respect, defend & encourage cognitive autonomy.
The contrast between these two categories of spaces will grow starker over time.
https://m.primal.net/QXCA.webp
Painting: The Opium Den, Yasuo Kuniyoshi. Undated

2025-04-20 10:52:40

Constant algorithmic improvements have empirically reverse engineered the human psyche.
I suspect that explicit research neuroscience hasn't caught up to the insights about how to induce behavioral dependence that are embodied in these systems.
The user experience of most platforms now mirrors maladaptive behavior-maintaining effects you could *only* achieve with most addictive drugs up to about a decade ago.
We need to avoid the moral panic, but it's impossible to overstate how novel this is for our brains.
One thing we know from behavioral addiction research (my old field) is that the brain is plastic.
When you induce one category of addiction, it changes the motivational substrate of the brain in sticky ways.
And coss-sensitizes / potentiates other forms of addiction and behavioral dependence.
This will only accelerate & become less scrutable with improvements in AI.
We are in the earliest, earliest days of trying to understand what this means for the next decades of human life.
Painting: The Opium Den, Edward Burra,1933
https://m.primal.net/QXBE.jpg

2025-04-14 13:10:55

NEW: 🇪🇺EU issuing burner phones to staff traveling to 🇺🇸US.
Anecdotal: matches what I'm seeing, which is orgs retooling what was once the high security "China travel policy" into a US travel policy.
Burner phones, dedicated travel devices & border wipes are the new normal.
Story: https://www.ft.com/content/20d0678a-41b2-468d-ac10-14ce1eae357b
https://m.primal.net/QPHR.png

2025-04-03 18:25:46

https://m.primal.net/QDHd.png
Anyone come across good analyses of new US #tariffs .
Longer term projections a bonus. #AskNostr

2025-03-31 02:54:53

- reply

The wild and horrid thing is that the answer is: sorta.
Yes when you use a VPN your ISP can't passively collect your data (though through DPI they can know what VPN you are using & possibly the IP of your endpoint)...
But plenty of ISPs user data businesses are already enriching data profiles about you from things like advertising exchanges & surveillance SDKs that will keep working (& are still uniquely associated with you) through the VPN's tunnel. Which is a horrible reality of the multiply tracked digital shitscape.

2025-03-31 02:24:05

- reply

Very cool, tag me when you post it I'd love to listen.

2025-03-31 00:40:07

- reply

Ultimately, more friction around simple forms of tracking & user data grabs is good, but there is still a huge gap between how users understand VPNs & what the provide...vs the much more limited benefits that they actually provide
No VPN will ever be close to a silver bullet for privacy or security, but it's nice to see design choices that address weakpoints.

2025-03-31 00:33:19

- reply

Thoughtful design that addresses one of the biggest issues around VPN use & privacy: a single chokepoint point of possible privacy failure & exposure to demands for access.
There are still lots of things VPNs don't do..that people think they do.. but this kind of thing is nudging consumer VPNs closer towards what people think when they use them :)
Example of what ppl think VPNs do but they don't: hiding from most websites you visit. Unless you are actively resisting things like browser fingerprinting, cookies, trackers & never logging in, you're still identifiable to most of the sites you visit.
Here's another: a state can still find you if you use a VPN. Trivially, if they can get enough traffic logs. For example, if SERVICE A still has an IP address + time pairing associated with you that is uniquely identifiable (e.g. you touch your email inbox over your VPN connection).. then there's a good chance that a state can quickly associate you with your other activity on SERVICE B. All they need to do is make a legal request that SERVICE A complies with. Then they see what IP is associated with you at that time, maybe get your useragent & a few other things and ...boom.

2025-03-30 22:35:44

- reply

Great job @nprofile…5kd8 . You lasered on some key themes and took open questions right towards the important stuff. That segment was better because they had you on!

2025-03-30 21:00:50

https://m.primal.net/PyiS.jpg I've spent my adult life thinking about defending digital privacy.
Yet until a few years ago, financial freedom & privacy was barely on my radar.
This would have probably continued but for a handful of good humans that took the time to talk me through things.
Thanks to thinking they kicked off for me, I now think that individual access to aspects of financial freedom & privacy are necessary to a healthy society.
Why did it take so long? Well, there was a failure of adversarial imagination on my part.
And partly because if you aren't actively asking hard questions, this state of affairs will be hidden from you.
The financial system & how it is taught is set up to hide structural privacy violations & disempowerment.
I'm pretty sure my ignorance was closer to the norm than the exception.
But when you completely restrict financial privacy & freedom, you disempower people...constantly.
And it will keep eroding & blocking the exercise of other core rights.
Until this changes & awareness grows, we're stuck paying the price for it in a thousand ways.
Shoutout to @nprofile…xncl for getting & keeping the intellectual ball rolling for me. And to all the good humans that have helped me along the way since. Thank you. You know who you are.
Painting : Egon Schiele, Four Trees, 1917.

2025-03-30 03:58:03

- reply

Now to figure out what *actually better* looks like

2025-03-30 00:58:15

- reply

I hear what you are saying, and agree that this kind of advanced data collection probably is not necessary.
My view is: don't underestimate the power of these industries.
Consider that there's a difference between what kind of invasiveness might be needed.... and what will be instantly sought & probably granted.
Getting concrete. The cheaper bids on contracts will probably be because they rely heavily on more automated approaches... And to make that work, they are going to want data.

2025-03-30 00:53:36

- reply

I hear you. I worry that a goldrush of some of the shadiest companies will happen in a blink.
Surveillance-oriented-companies love nothing more than areas where people *have to hand over data*.
And the "we need this data to keep ppl safe" fear thing is going to be a godsend.
If we aren't demanding that concerns about safeguards, limits & accountability are included in every step of the conversation now...it will be 100x harder to get them in place once big companies & lobbyists have set the terms of the game.

2025-03-29 21:56:02

Most folks don't love security theater & everyone has had a bad time at a screening checkpoint.
So, let's think for a second about hypothetical private-#TSA companies.
I'd expect them to gravitate towards AI-assigned individual risk ratings to minimize the cost of hiring & training people to interact with travelers.
To create ratings, I'd expect them to demand & consolidate invasive pools of our biometrics, web browsing, commenting, purchasing, movements & private lives.
Just don't call it a "social credit score"
You can bet they'll pivot to trying to monetize their data.
2026: We're a terminal security company
2029: We're a person rating company
Would these ratings make their way into other parts of our lives & things we want to visit?
And who exactly would stand up for us when the ratings are wrong? Or our data is shipped to foreign buyers.
Who holds #PrivateTSA companies accountable? The US doesn't have strong #privacy protections...
I'm also not optimistic about private sector security companies' ability to stop breaches. History backs me up here.
But I do expect that private-TSA companies could use lobbying to limit oversight & accountability.
That's been the history of other privacy-invasive tech companies.
So, as an airline security privatization conversation kicks off, remember that it can't just be "current thing is bad" but needs to consider what kind of future we're inviting in. https://m.primal.net/Pxhw.png

2025-03-29 19:45:32

- reply

PS: I was going to #Zap you but don't see a lightning address. If you do set one up, let me know!

2025-03-29 19:44:27

- reply

Thank you Jason!

2025-03-29 17:51:45

- reply

Was having the same reaction https://primal.net/e/nevent1qqsy0p7khgqqmhcjslkdp3qv0evqe4x7knlqg2mmvckgpp79vtthewqe3gtn9

2025-03-29 17:48:59

- reply

Did some math:
1944: New House = 1.4x yearly income
2023: New House = 5.3x *median* household income
(2023 New US house $427,400, Median US individual income $80,610)
Then got interested & found some more data and graphed it (starting 1984, note that it's sales price, not new house, but trend is clear) https://m.primal.net/PxVa.png

2025-03-29 01:32:36

- reply

Thanks much, great stuff!

2025-03-28 22:02:34

- reply

slushwave: new term for me! Thanks!

2025-03-28 22:01:51

- reply

haven't listened. do you have a suggested track?

2025-03-28 20:11:09

What's your best focused work music?
I'm getting habituated to mine.
Please drop a link.

2025-03-28 18:36:58

A journalist asked me: why does NSO Group keep getting caught?
Isn't #Pegasus supposed to be undetectable?
My answer: because the maker of Pegasus spyware isn't as good at hiding their activities as their government customers believe.
https://m.primal.net/PwUG.png
Making it worse for customers, Pegasus spyware customers fate share.
If a gulf dictator abuses Pegasus against an activist & get caught..this impacts the whole customer base when the zero day gets burned.
https://m.primal.net/PwTy.png
This is because the main mercenary spyware model involves selling the same tech to multiple customers.
https://m.primal.net/PwUB.png
This includes building & maintaining customer infrastructures for things like infecting, command & control, and exfiltrating data from phones.
Similarly, as researchers, when we get a first bit of that spyware infrastructure, we fingerprint... and expand out from there. Like we did with Paragon spyware.
https://m.primal.net/PwUM.png
Often the result is to surface new customers since the tech is going to multiple clients. https://m.primal.net/PwUK.png
And yet again... customers fate share.
This dynamic is likely to continue as long as companies proliferate mercenary spyware to a broad customer base... the spyware gets abused... and researchers like us keep hunting for abuses.
Story: https://techcrunch.com/2025/03/28/again-and-again-nso-groups-customers-keep-getting-their-spyware-operations-caught/

2025-03-28 03:51:23

- reply

Highly recommend. Farrow gives victims space to speak about the experience of being targeted with such invasive tech & covers some investigative work we're very proud of.

2025-03-28 03:28:28

NEW: Italian gov reportedly admits it targeted activists with #Paragon mercenary spyware.
After ~2 months that began with denials & slid into evasions, some clarity finally came. But only some...
https://m.primal.net/Pvti.png
The spyware targeting of journalist Francesco Cancellato, the first case to come forwards after he got notified by #WhatsApp at the end of January is still unexplained.
We at #Citizenlab have been investigating the case & working with targets. We published a forensic investigation last week. Lots of unanswered questions.
Company Background:
Company frames themselves as the anti-NSO Group (the notorious Israeli spyware company that makes Pegasus spyware). More stealthy. More ethical. Well, they got caught & they now have a big scandal.
Like NSO, Paragon also originates out of alumni from the Israeli intelligence community but was recently acquired by a US defense contractor.
Up Next?
As long as clarity is incomplete... the #Paragon scandal isn't going away for #Italy ... and Italy is going to remain a major pain for the mercenary spyware company.
Report: https://www.euractiv.com/section/politics/news/spyware-scandal-italian-government-reportedly-admits-targeting-activists/
https://primal.net/e/nevent1qqs8us77wawnjryeacpq0cup22pvwdnhyv6k69fmkadf5r34rppp7usyhlr4e

2025-03-27 17:58:44

So, more journalists were just targeted with #Pegasus spyware.
This time journalists in #Serbia that were investigating corruption.
https://m.primal.net/PvTf.png
“In Serbia, you can hire a hitman for a half of the money...what else would they be prepared to pay for?!” - a spyware-targeted reporter.
Indeed.
https://m.primal.net/PvTk.png
Notice that the targeting is happening over a messenger program with a link, not a zero-click?
The why is unclear. Maybe Pegasus didn't have a working exploit against those phones. Or maybe the customer didn't get the platinum zero click package and so had to do some social engineering. Interesting.
BACKGROUND:
This is the THIRD report of Pegasus abuses in Serbia in 2 years.
And nearly a decade after the first Pegasus abuses got reported, NSO Group is still fueling attacks against freedom of speech.
We're here because spyware companies still don't feel meaningful consequences.
https://m.primal.net/PvTm.png
And DC is home to a seemingly-infinite number of lobbyists that are willing to help them try to get off sanctions lists...
READ THE REPORT by Amnesty Tech & BIRN. https://securitylab.amnesty.org/latest/2025/03/journalists-targeted-with-pegasus-spyware/

2025-03-27 17:45:15

BREAKING: more journalists targeted with #Pegasus spyware.
This time journalists in #Serbia that were investigating corruption.

2025-03-26 21:47:12

Private data & passwords for US officials found online?
Sure. This is true for every official, regardless of party.
And you, if you're an American reading this.
The US hasn't enacted serious privacy protections for citizens. https://m.primal.net/PuNS.png
This is a consequence.
Companies intrusively soak up your personal data, get breached, and nobody blinks. https://m.primal.net/PuNT.png
Breaches are one of the first places attackers go when they want to target.
https://m.primal.net/PuNW.png
This is why password re-use is dangerous. And two factor authentication is key.
If your favorite 'strong password' is in a breach, an attacker is going to try it against every other account you have.
https://m.primal.net/PuNZ.png
Story: https://www.spiegel.de/international/world/hegseth-waltz-gabbard-private-data-and-passwords-of-senior-u-s-security-officials-found-online-a-14221f90-e5c2-48e5-bc63-10b705521fb7

2025-03-24 18:47:40

Datapoint: this administration uses Signal. Like every other administration.
Because encrypted messaging is critical infrastructure.
Remember this the next time a government demands an encryption backdoor.
https://m.primal.net/Priw.png
How did a reporter get added? Well, the use of encrypted chat is ubiquitous but not explicitly accepted, supported or discussed in most institutions.
Which means users are left to fend for themselves in how they use & understand these tools.
And are usually about 1 mistake away from self-doxxing group contents.
https://m.primal.net/Prix.png
This also left me wondering: is anyone screening these devices for mercenary spyware like Pegasus?
https://m.primal.net/PrjS.png
Experience tells me the answer is: maybe not.
Article: https://www.theatlantic.com/politics/archive/2025/03/trump-administration-accidentally-texted-me-its-war-plans/682151/

2025-03-24 17:37:37

Some of the least exploitative consumer interactions happen between individuals & small / local vendors. These have the potential for mutual trust and reciprocity + possibility for sanctions in both directions if trust is violated.*
Trust + your private information is held in a distributed way & there are some social protections for your data.
A small shop gets hurt if you stop patronizing them because they violated your trust, for example. And if you cheat your nearest grocery store and they refuse you service, this is a cost for you.
These relationships are increasingly being replaced with unidirectional information harvesting where all arrows of data sharing point to the intake pipes of a centralizing enterprise.
The more this happens, the more the power consolidates up. And payment processors are speeding the process... trying to become the intercessors in those trust dynamics.
Your data heads to companies whose incentive is to always exploit any biometric / personal information you share with them for every-profitable-thing they can think of. Collecting biometrics to validate a trusted transaction becomes...hey we now have a new identity database we can sell for mass surveillance.
The incentive will always be data disempowerment: propagate your info as widely as profitable, far outside of what you would ever want or meaningfully consent to.
The bigger the set of such data & the more centralized, the more potential for harm...
And the lower the ability for any individual that has been burned by the transaction to meaningfully sanction the entity that abused their trust/ information.
*of course there are always edge cases where the vendor is small but super wealthy/connected etc and the consumer isn't. The point is that the further we get from this, the greater the chance that the dynamic is fully unequal.#nevent1q…d2m0

2025-03-24 03:22:13

Happy stuck ship anniversary.
Hard to imagine being able to epically tell that story on legacy social media today.
I feel in my bones that any attempt at such a participatory longform conversation where expertise is shared across days would be drowned out with AI slop, herded partisanship, and lowest common denominator engagement-farming.
https://m.primal.net/Pqwj.png