jsr

chasing badness

Public Key

npub1vz03sm9qy0t93s87qx2hq3e0t9t9ezlpmstrk92pltyajz4yazhshfttwj

Profile Code

nprofile1qqsxp8ccdjsz84jccrlqr9tsguh4j4ju30sac93mz4ql4jwep2jw3tcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduq32amnwvaz7tmwdaehgun9d35hgetn9ehhyecv4jgm4

Publishing to

relay.damus.io

nostrelites.org

relay.primal.net

Author Public Key

npub1vz03sm9qy0t93s87qx2hq3e0t9t9ezlpmstrk92pltyajz4yazhshfttwj

Show more details

Last Notes

2025-02-10 18:43:38

Full biometric KYC for a sandwich.
Absolutely not, Jeff.
https://m.primal.net/OWgA.png

2025-01-29 22:53:06

#nostr, you just zapped my post hard enough to pay for tasty tacos.
Amazing.
P.S. Current energy reconversion: 1 sat =18 kcal
https://m.primal.net/OGpe.png
#nevent1q…8448

2025-01-29 17:34:19

No notes.
#deepseek #openai https://m.primal.net/OGSV.png

2025-01-29 03:28:20

- reply

Welcome to nostr!

2025-01-28 16:57:10

- reply

YES

2025-01-28 16:13:29

Watching journalists get censored on deepseek app
I'm glad to see the conversation about censorship in AI entering into new spheres.
Hoping that the concerns stick.
https://m.primal.net/OEcO.png

2025-01-28 04:59:24

Monday edition of *Car privacy is an absolute nightmare*:
https://m.primal.net/ODrS.png
Subaru's employee portal holds a year's worth of location data for all internet-connected cars. https://m.primal.net/ODrt.png
We know this because it was vulnerable (now fixed). You could pull a year's worth of driving just with a license plate.
https://m.primal.net/ODrn.png
Props to Sam Curry & Shubham Shah for exposing it. Pic is a years' worth of Sam's mom's #Subaru locations.
I seriously doubt any owner has a clear idea that this data is being collected on them.
But the same thing is replicated for almost every car mfr (see the #Mozilla foundation report on car privacy link)
Literally no car owner has asked for their whip to be turned into a surveillance portal.
And yet..
Car companies feel basically no pressure to do right by customers, but experience a lot of incentives to mine their movements for money.
Sidenote: same (now closed) vulnerability also enabled remote unlocks & starts and a bunch of other highly undesirable things.
Reading list:
The Subaru research: https://samcurry.net/hacking-subaru
News report on it: https://www.wired.com/story/subaru-location-tracking-vulnerabilities/
Mozilla Foundation's key investigation into car privacy: https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/

2025-01-28 04:35:49

- reply

Agreed

2025-01-28 04:13:20

- reply

Great suggestion, @nprofile…h36r is a gem

2025-01-28 00:03:13

Who on #nostr is saying interesting things about #privacy?
Help me fill out my follows!

2025-01-28 00:01:29

- reply

Maybe we need to hire a bunch of amazing marketers to help message test privacy.

2025-01-27 21:08:51

- reply

We are in the earliest days of sensing the privacy implications of incorporating #chatgpt / #deepseek et al. into our lives.
I think this period will be viewed as a time of a massive willing...but not fully witting... transfer of personal information, right down to our ways of reasoning & understanding the world...into the hands of a new set of companies & their CEOs.
The same companies that have the ambition to shape how we think.
And shape how society looks.

2025-01-27 14:54:05

- reply

spywareland is a wild world!

2025-01-27 14:49:37

- reply

Thank you!

2025-01-27 03:17:19

- reply

Thank you @nprofile…thgr I'm excited to he here.

2025-01-27 02:59:59

- reply

UofT!

2025-01-27 00:35:35

- reply

will check it out

2025-01-26 23:56:10

- reply

oh yeah me too @npub14j6…jvl6

2025-01-26 23:55:19

- reply

hey @npub1k3v…3dmq thank you i am excited

2025-01-26 23:52:58

- reply

thank you @npub12sj…k6jg

2025-01-26 23:47:51

- reply

thank you @npub16eu…t6jc im feeling the love

2025-01-26 23:37:50

- reply

you may indeed be thinking of us. or maybe one of the dedicated helplines for activists like AccessNow

2025-01-26 23:34:21

- reply

too kind! I call us researchers and ngos collectively an accountability ecosystem and I am proud to be part of it

2025-01-26 23:30:46

- reply

Thank you brother!

2025-01-26 23:29:55

- reply

we exposed Pegasus, we dont make spyware ;)

2025-01-26 23:28:29

- reply

Glad to hear. I'm fortunate to work among so many good ppl

2025-01-26 18:35:40

- reply

Starterpacks are smart and they create all sorts of desirable network effects.
When I locate Bluesky really taking off, a big part of that was people being able to quickly recreate the kinds of information feed they were getting elsewhere by following interest starterpacks.
This also sent a signal to ppl that put a lot of effort into their posting: there's a way for you to grow & help others grow quickly.

2025-01-26 18:33:25

- reply

I'm glad you found it interesting. Love the podcast.

2025-01-26 18:27:50

- reply

thanks! I love making good trouble

2025-01-26 18:22:55

- reply

Thank you. Excited to flex my freedoms

2025-01-26 18:22:06

- reply

Thank you! Excited to be sharing here.

2025-01-26 18:21:40

- reply

It helps us understand what the communities we serve face every day.

2025-01-26 18:20:20

- reply

Thank you. I'm grateful to be able to do it. And have so many smart collaborators.

2025-01-26 18:18:53

- reply

as a large language model i cannot...

2025-01-26 18:18:27

- reply

Thank you. I'm fired up.

2025-01-26 18:18:05

- reply

Thank you for the good energy!

2025-01-26 18:17:46

- reply

Glad you enjoyed it! Which one?

2025-01-26 18:15:59

- reply

ONWARDS

2025-01-26 17:32:32

- reply

What a nice thing to say, hi @nprofile…hppf !

2025-01-26 16:53:05

Hi everyone, I'm JSR.
Me & my colleagues chase government hacking & censorship of dissidents & activists.
Heard of Pegasus spyware? Then you know about our work.
I'm part of the Citizen Lab, a ferociously independent research group based at the University of Toronto.
We try to 🥊punch above our weight.
Your device has probably gotten security updates that flowed from our collaborative investigations.
Craziest story? When we punked a team of mercenary🕵️ spies sent to target our research. https://www.youtube.com/watch?v=Z8IrU_jvnFk
I'm so proud of my colleagues & talented collaborators in the fight to serve fat helpings of good trouble & accountability.
All the good research I've worked on has been a team production... But everything I say here, especially the typos & bad ideas are100% mine.

2025-01-26 16:16:33

This. No accident that legacy platforms slide towards restricting access by researchers.
After the acquisition of Twitter, an underreported play was freezing out any meaningful research into manipulation by gatekeeping the API & firehose.
So users are left with "this feels weird" & few ways to know more.
#nevent1q…st0f

2025-01-26 05:21:59

- reply

Indeed so. I should have included the link https://www.bbc.com/news/articles/c5y3pdp099zo

2025-01-25 19:08:36

- reply

Good question. Imagine your user never tells you their age or gender or feelings, but you use big pools of data & some ML to make a guess that it is an underage girl.
Then sell targeting of ads on them based on these inferences. And maybe a few others, like about the depression and insecurity she is struggling with & might be predisposed to buy.
It gets even creepier when the inferring is about finding signals for non-users and constructing shadow profiles. E.g. *your* kid.
https://m.primal.net/Nzxb.png https://m.primal.net/Nzxf.png

2025-01-25 19:00:07

The official instinct to solve all problems by application of surveillance dystopia is a feature, not a bug.
https://m.primal.net/Nzwy.png https://m.primal.net/NzxA.png

2025-01-25 02:59:50

- reply

Indeed this is usually true.
For Cyd, they have a pretty logical pricing model, great privacy policy, are open source & I can personally vouch for the integrity of the lead dev. https://m.primal.net/NyvW.png

2025-01-25 02:10:59

- reply

Thanks, it feels good

2025-01-25 01:57:50

- reply

Been experimenting with local R1 distills and how they answer logic problems.
The deductive-flavored reasoning is fascinating...
https://m.primal.net/Nyrf.png
But the political limitations are pretty clear too. https://m.primal.net/NyrY.png
In some cases you get a limitation when you talk about a sensitive topic directly.
In others, it will helpfully show *thinking about censorship that contains the censorship*
https://m.primal.net/Nyrl.png

2025-01-25 00:51:23

- reply

Accurate. I think we are only in the earliest stages of understanding just how much harm they are capable of causing.

2025-01-25 00:50:04

- reply

Yeah. The distinction between realtime censorship of outputs and model-generated propaganda is fascinating. I'm especially interested in the dynamic of models like R1 that can be used to train derivative models...
Who knows where those tendrils of propaganda will eventually wind up...

2025-01-25 00:36:50

- reply

It's really more of an *is anyone not trying to hack us?* scenario in my experience.
We got here because doing so has been largely a consequence-free zone

2025-01-24 23:37:33

- reply

Here's what I found.
https://primal.net/e/note1r62wf5rn7gy3pre7g06c0swqf69yledrqudp8el3y9rn2z2c8kdsqhgy90

2025-01-24 21:00:58

- reply

If you run a local version of an R1 derivative model it does not happen.
Although those models have interesting answers about Taiwan. https://m.primal.net/NyXZ.png
And if you try to spring the same question in a dialogue about something else, you get a bit more verbose a response.
Pay attention to the reasoning.
https://m.primal.net/NyXe.png

2025-01-24 20:45:57

NEW: the US is seeking extradition of an Israeli private spy over sprawling hack & leak operations against 🇺🇸American nonprofits.
Let me tell you a story... https://m.primal.net/NyUq.png
Amit Forlit's alleged customer: a US lobbying firm named DCI Group...representing oil & gas giant ExxonMobil.
https://m.primal.net/NyUc.png
IT BEGINS
The criminal case was triggered back in 2018, when US-based nonprofits targeted by hackers whom we'd been working with requested that we notify the authorities.
We'd found an absolute raft of targeting and attributed the fingers-on-keyboards to an Indian hack-for-hire operation.
THE TARGETS
Targets ranged from environmental orgs to net neutrality advocates , everyone that asked questions about massive financial fraud by payment processor WireCard & so many more.
https://m.primal.net/NyVt.png Our friends at EFF also spotted the phishing against net neutrality orgs & reported on it, we later attributed it to the Indian group.
https://m.primal.net/NyVG.png
TIME TO NAME & SHAME
We published alongside Reuters, naming the Indian group (BellTrox) back in 2020. https://m.primal.net/NyWE.png
TWO ISRAELI PRIVATE SPIES...
Fast forward to today's efforts to extradite Amit Forlit, who was arrested at Heathrow last year.
He's actually the *second Israeli private investigator* charged in this massive hacking scheme.
The first, Aviram Azari, was arrested in 2019 on his way to Disney World, convicted & is serving out his sentence. https://m.primal.net/NyVM.png
The US accuses Forlit of serving as a go-between for Indian hack-for-hire groups.. and a global client list. https://m.primal.net/NyUw.png
The US doesn't name the lobbying firm or the big oil and gas company in their filing.....but Forlit's own lawyer helpfully filled in the details, as reported by Reuters. https://m.primal.net/NyUf.png
THE SCHEME
The operation targeting environmental groups is pretty wild, and when we timelined phishing attempts against their advocacy strategies. The targeting was smart & super-aware of relationships between the targets. https://m.primal.net/NyUr.png
When hacking is corporate, they make memos.
https://m.primal.net/NyUx.png https://m.primal.net/NyVA.png
And email about them.
"Why the *** was he sending e mails what a dumb arse"
https://m.primal.net/NyUy.png
Epic line: The kind of message that prosecutors of...
TAKEAWAY
Today, many legal fights, including attacks on nonprofits & civil liberties groups, have a secret undercurrent of hacking-for-hire. https://m.primal.net/NyWd.png
The powerful interests that commission the hacking & benefit from the often-manipulated 'leaks' escape consequences.
But if you are around these issues, you may get targeted too.
This case goes further up the chain than any before. We'll see just how high, but it is great to see some consequence brought to this shady ecosystem.
I'll keep folks here updated.
Reading list:
Our Citizen lab investigation:https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/
EFF report on targeting of net neutrality orgs: https://www.eff.org/deeplinks/2017/09/phish-future
Report on Forlit hearing: https://www.reuters.com/world/israeli-private-eye-wanted-us-over-alleged-hacking-exxon-lobbyist-lawyer-says-2025-01-22/
Aviram conviction story: https://www.reuters.com/technology/cybersecurity/israeli-private-detective-sentenced-us-6-23-years-hacker-for-hire-scheme-2023-11-16/
Today, many legal fights, including attacks on nonprofits, have a secret undercurrent of hacking.

2025-01-23 20:51:05

- reply

A lot of people want to.
Conceptually.
But the practicalities and fear of the first step are a lot of friction.
Key is to identify people that are like this and help them reduce the friction & fear & see their way to joining this exciting world.

2025-01-23 18:42:42

- reply

Extreme darkness down this path

2025-01-23 18:41:19

- reply

Working to convert it to run on seed oil.

2025-01-23 18:40:13

- reply

My dream: an open community with a wiki per model showing how to do this. Something you could do yourself as a DIY or hand to your mechanic.

2025-01-23 17:37:13

- reply

It runs on coal.

2025-01-23 17:36:33

- reply

I just got zaps for the first time last night 😉

2025-01-23 16:28:06

Wait, people can support me in real value, not just magic internet points that are revokable without notice?
Zaps just blew my mind.

2025-01-23 15:38:25

- reply

Too kind, try again?

2025-01-23 15:35:58

Europe is preparing for another assault on encryption.
https://m.primal.net/NwXN.png

2025-01-23 05:11:57

- reply

having spent some time unscientifically but persistently comparing LLM censorship in response to the same prompts with CN and US models I'd say that some CN models I've explored have galaxies of off limits outputs. however they are different. so you need to ask the kinds of questions that get these answers. Which means you need to focus on censored themes in China. Like the five poisons...
https://www.businessinsider.com/chinas-spy-agencies-five-poisons-taiwan-tibet-uighur-democracy-2023-8

2025-01-23 05:00:16

- reply

Too kind! Thank you

2025-01-23 04:59:36

- reply

What a nice thing to say! Thank you @npub1trr…hdpu

2025-01-23 04:51:58

- reply

Orwell would be proud

2025-01-22 18:45:56

We need #encryption backdoors to 'enforce' democracy says Europol chief.
Says anonymity "not a fundamental right"
https://m.primal.net/NvDQ.png
I disagree.
#Anonymity is part of the bedrock of protecting healthy dissent.
Forcing total government access to private communications lays the technical groundwork for undermining democracy.
https://m.primal.net/NvDk.png
But here we are. It's a new year, so cops & governments are taking fresh swings at encryption.
Only the scare tactics change.
Welcome to a new, cynical chapter in the fight to protect privacy.
https://m.primal.net/NvDq.png
Demanding them... when the worst recent national security breaches in the US happened... when #China hacked government-mandated backdoors... is also absurd.
There's every reason to believe something similar may have happened in #Europe , we just don't know it yet.
Shortsighted and cynical stuff.
Story: https://www.ft.com/content/1e6a600d-8620-4ed6-a4cd-5c454d6247ba

2025-01-01 01:26:41

Happy New Years.
Friends & strangers fighting good fights for #freedom, thank you.
May you sleep easy... the autocrats sleep queasy
...and the spirit of resistance to tyranny keep burning bright.

2024-12-31 00:01:09

NEW: #China gov hackers breached #TreasuryDept
Not a ton of clarity on what was taken yet.
Sounds like it went like this:
STEP 1:Targeted Treasury security vendor #BeyondTrust
STEP 2: Stole BT's key for support platform
STEP3: tech support platform becomes backdoor on #Treasury machines
Ouch.
https://m.primal.net/NLzO.png
Analogy-ish: burglar breaks into plumber's office & steals master keys to the buildings they service...
Given BeyondTrust's big client list, presumably with many juicy targets for the #PRC it makes you wonder who else may have been targeted.
https://m.primal.net/NLzP.png
Talented reporting crew of Raphael Satter & AJ Vicens point to a recent posting by BeyondTrust about an incident that identified a series of vulnerabilities in their remote support tools.
https://m.primal.net/NLzW.png
Sure sounds like this is it...
https://m.primal.net/NLzc.png
Tom Hegel rightly points out the longstanding pattern of hackers from #China targeting trusted 3rd party platforms (hello cybersecurity, identity & authentication vendors!) to go after big targets.
https://m.primal.net/NLzY.png
Pulling back a bit, this is a good reminder that #cybersecurity for most institutions today is heavy with services from 3rd party vendors.
Which means a complex layer of threat for defenders who also have to worry about the first order problems the #infosec vendor products seek to address...
Good times for the gov-backed #hacker class.
Reuters: https://www.reuters.com/technology/cybersecurity/us-treasurys-workstations-hacked-cyberattack-by-china-afp-reports-2024-12-30/
Beyond Trust: https://www.beyondtrust.com/remote-support-saas-service-security-investigation

2024-12-23 16:06:07

Predators are targeting your parents.
The volume of scam phone calls targeting elderly people in the US is insane.
If you've visited an aging person, you know what I'm talking about.
If not, just ask any retired person you know.
Several calls a day on their landline isn't out of the ordinary.
Every time the phone rings there's a chance that the person faces a risk of wiping out their savings.
Foreign scam call centers are running on an industrial scale.
The situation is like an opportunistic infection.
It is a symptom showing that the US phone system's defenses aren't up to the task.
With increasingly clever AI/ deepfake voices & automation, the #Scam call problem is set to get worse.
Last year we got a hearing on phone scamming of seniors by
the Senate Aging Committee.
We need many more.
We need lawmaking with teeth.
And we need accountability at every level.
https://www.youtube.com/watch?v=7CMhzgQdz_I

2024-12-23 03:50:10

VPN advertising is the most common source of security misinformation I encounter.
The industry is a scourge.

2024-12-21 05:30:54

- reply

6/ The victims in the 2019 hack had been targeted with a simple missed video call exploit.
https://m.primal.net/NCKU.png
No action required, and once-infected, the call log would typically be deleted.
https://m.primal.net/NCKT.png
We at Citizen Lab volunteered help investigate the target list and try find journalists, dissidents, and human rights defenders.
We found a lot.
And plenty of unexpected pockets of repression. Like the targeting dissident members of the clergy in Togo. https://m.primal.net/NCKX.png
https://m.primal.net/NCKW.png

2024-12-21 05:27:01

- reply

5/ In the years after #WhatsApp sued NSO, much happened.
More court cases were filed against the #Pegasus spyware maker.
And in November 2021 NSO got hit with US sanctions.
But thankfully, WhatsApp stuck to the case for five years even as NSO seems to have tried every-available-trick to slow-roll & delay.
To some, it looked a lot NSO was being arrogant.
To others, like a company that truly held itself above any law...
Ultimately NSO's legal tactics seem to have gone over badly with the judge, resulting in today's summary judgement.

2024-12-21 05:25:39

- reply

4/ WhatsApp suing NSO Group was a huge deal at the time.
We at Citizen Lab & our peers in civil society had been investigating & surfacing a pile of #Pegasus abuses since 2016. Journalists, dissidents, truth-tellers, scientists, lawyers..
But nobody was taking action & NSO was flying high.
The ultimate digitally-enabled playground bully.
For years, governments seemed content to let the mercenary spyware industry live in the shadows...
NSO's valuation & client list ballooned.
Meanwhile, NSO constantly misled reporters, nurtured disinformation about researchers & blamed spyware victims..
And then they got sued by a very big company that chose to stick up for its users & security.
Suddenly, NSO wasn't on such sure footing. https://m.primal.net/NCKK.png
WhatsApp had their own factual, technical analyses, and plenty of resources
https://m.primal.net/NCKN.png
Suddenly they couldn't just claim that a few researchers were out to get them.
https://m.primal.net/NCKF.png https://m.primal.net/NCKH.png https://m.primal.net/NCKI.png https://m.primal.net/NCKJ.png

2024-12-21 05:20:49

- reply

3/ Today, the court decided that enough was enough with NSO's gambits & efforts to hide source code.
Judge Hamilton granted #WhatsApp 's motion for summary judgement against the #Pegasus spyware maker.
The judge finds NSO's hacking violated the federal Computer Fraud & Abuse Act (#CFAA), California state anti-fraud law #CDFA, and was a breach of contract.
What happens next? The trial proceeds only on the issue of resolving damages stemming from NSO's hacking. https://m.primal.net/NCJv.png
Order: https://storage.courtlistener.com/recap/gov.uscourts.cand.350613/gov.uscourts.cand.350613.494.0.pdf

2024-12-21 05:19:14

- reply

2/ In 2019, 1,400 WhatsApp users were targeted with #Pegasus over a 2 week period alone. https://m.primal.net/NCJp.png
WhatsApp did the right thing & sued NSO Group.
NSO has spent 5 years trying to claim that they are above the law.
And engaged in all sorts of maneuvering.
With this order, the music stopped and NSO is now without a chair. https://m.primal.net/NCJq.png

2024-12-21 05:18:08

BREAKING: NSO Group liable for #Pegasus hacking of #WhatsApp
users.
Big win for #spyware victims.
Big loss for NSO.
Bad time to be a spyware company.
Landmark case. Huge implications.
Here's the story1/
https://m.primal.net/NCJj.png https://m.primal.net/NCJl.png https://m.primal.net/NCJm.png https://m.primal.net/NCJn.png

2024-12-20 15:46:34

- reply

3/ CISA's guidance for Android starts from the unavoidable fact that many Android manufacturers truly don't respect users security or privacy.
https://m.primal.net/NBjQ.png
So, ✅pick a company that won't leave you insecure after 2-3 years.
https://m.primal.net/NBjS.png
Other good guidance here includes...
✅ Only use RCS with end-to-end encryption
✅ Using Android Private DNS
✅ Use Enhanced Protection for Safe Browsing
✅ Google Play Protect
✅ Manage permissions.

2024-12-20 15:44:24

- reply

2/ So CISA's top recommendation for Apple users is: ✅ enable #LockdownMode
https://m.primal.net/NBjK.png
It's also my top guidance for high-risk #iPhone users..
Because as researchers tracking sophisticated threats we see Lockdown Mode blunt advanced attacks...
Here's how to turn it on:
https://m.primal.net/NBjL.png
Other solid guidance:
✅Protect your DNS
✅Disable fallback to SMS
✅Enroll in iCloud Private Relay
✅Trim App permissions.
Also typo above: that's Cybersecurity and Infrastructure Security Agency 🙃

2024-12-20 15:38:16

USE ONLY END-TO-END ENCRYPTED COMMS says 🇺🇸CISA*
Yes!
End-to-end encryption is critical infrastructure for a safe society.
https://m.primal.net/NBiv.png
They have other mobile security guidance, but first... how did we get here?
Well we've come to a a point predicted by security & privacy people for a long time: the brittleness of our infrastructure security is such that even government agencies' guidances says use end-to-end encryption.
Because our networks are so penetrated & vulnerable that this is the only reliable way to protect Americans inside the US from ...foreign interception.
Wild time to be alive.
*US Cybersecurity and Infrastructure Agency

2024-12-20 15:25:12

The US is considering banning TP-LINK routers.
https://m.primal.net/NBiO.png
Company has the majority market share in US for homes & small biz. https://m.primal.net/NBhr.png
Concerns stem from Chinese-gov linked attackers repeatedly leveraging vulnerabilities.. and the company not taking much action.
The threat from TP-Link is real. Just look at how CovertNetwork-1658 runs a massive password-spraying operation from compromised routers. https://m.primal.net/NBhx.png https://m.primal.net/NBhv.png
On the other hand, not clear that banning router companies 1 by 1 is going to solve the other half of the problem.
Which, narrowly, is that most SOHO routers are just very vulnerable and used for years without updates. Many more even than random end-of-life Androids etc. And threat actors around the world are already exploiting this. Doesn't matter their country-of-origin, the threat is real.
More broadly, the issue is that accountability & oversight in the US around catastrophically privacy violating & insecure technology is a joke....
So that, as usual, the consequences flow to vulnerable users & systems...
Story: https://www.wsj.com/politics/national-security/us-ban-china-router-tp-link-systems-7d7507e6?st=oP8Bk2&reflink=desktopwebshare_permalink

2024-12-20 15:12:54

Hello again, world.

2023-02-21 20:08:58

Hello, world.

2023-02-21 19:30:47

- reply

So cool!