jsr

chasing badness

Public Key

npub1vz03sm9qy0t93s87qx2hq3e0t9t9ezlpmstrk92pltyajz4yazhshfttwj

Profile Code

nprofile1qqsxp8ccdjsz84jccrlqr9tsguh4j4ju30sac93mz4ql4jwep2jw3tcpr4mhxue69uhkummnw3ez6ur4vgh8wetvd3hhyer9wghxuet5qyv8wumn8ghj7urjv4kkjatd9ec8y6tdv9kzumn9wsukcewg

Publishing to

nostr-pub.wellorder.net

premium.primal.net

relay.damus.io

Author Public Key

npub1vz03sm9qy0t93s87qx2hq3e0t9t9ezlpmstrk92pltyajz4yazhshfttwj

Show more details

Last Notes

2025-04-24 10:46:05

Government censorship has come to #Bluesky.
https://m.primal.net/QbYz.png
LATEST:
On demands from the Turkish government, Bluesky restricted access to 72 accounts per a report from a Turkish NGO.
https://m.primal.net/QbXO.png
DETAIL:
Accounts are restricted for users in Turkey.
Accounts aren't banned from Bluesky's AT Protocol relays etc, but access is moderated at the official client level through geography-specific labels.
https://m.primal.net/QbXg.png
WORKAROUNDS?
Realistically impacted accounts are no longer visible to the majority of Bluesky users (most aren't on 3rd party clients) in Turkey.
However, since 3rd party client apps for the AT Protocol aren't forced to use geography-specific labels, they an still be used to view the content.
In theory, official client + VPN would also result in seeing the accounts.
LOOKING AT SOME DATA:
Bluesky has been publishing transparency reporting about legal & government requests. The most recent report covers 2024 and shows a relatively modest number of takedown requests, but about 50% response by Bluesky.
https://m.primal.net/QbYR.png
Unfortunately, the company doesn't differentiate between legal demands in civil litigation and *government* demands. This makes it hard to get a clear picture.
https://m.primal.net/QbYr.png
I hope Bluesky segments out these very different kinds of pressure in 2025 reporting so we can get a better sense of what's happening.
BIG PICTURE:
Looking ahead, governments are probing for new ways to enforce content restrictions. These are early days for Bluesky and it is likely that a lot more requests like this will be inbound as users head there to try and avoid the well-greased censorship machinery on legacy platforms like X.
Recommended reading & Sources:
Super-helpful-to-me TechCrunch article: https://techcrunch.com/2025/04/23/government-censorship-comes-to-bluesky-but-not-its-third-party-apps-yet/
Mastodon post confirming blocking with testing : https://mastodon.online/@mastodonmigration/114348331162291326
Bluesky post with the notification email screenshot: https://bsky.app/profile/aliskorkut.com/post/3lmul5pt34c2b
Bluesky 2024 Moderation Report: https://bsky.social/about/blog/01-17-2025-moderation-2024
Bluesky post describing geography-specific labels as a content-removal technique: https://bsky.social/about/blog/09-18-2024-trust-safety-update

2025-04-23 16:17:39

They Criticized Musk on X. Then Their Reach Collapsed.
https://m.primal.net/Qagt.png
Graphs from this story are stark.
https://m.primal.net/QahA.png
Link: https://www.nytimes.com/interactive/2025/04/23/business/elon-musk-x-suppression-laura-loomer.html

2025-04-14 13:10:55

NEW: 🇪🇺EU issuing burner phones to staff traveling to 🇺🇸US.
Anecdotal: matches what I'm seeing, which is orgs retooling what was once the high security "China travel policy" into a US travel policy.
Burner phones, dedicated travel devices & border wipes are the new normal.
Story: https://www.ft.com/content/20d0678a-41b2-468d-ac10-14ce1eae357b
https://m.primal.net/QPHR.png

2025-03-31 00:40:07

- reply

Ultimately, more friction around simple forms of tracking & user data grabs is good, but there is still a huge gap between how users understand VPNs & what the provide...vs the much more limited benefits that they actually provide
No VPN will ever be close to a silver bullet for privacy or security, but it's nice to see design choices that address weakpoints.

2025-03-30 21:00:50

https://m.primal.net/PyiS.jpg I've spent my adult life thinking about defending digital privacy.
Yet until a few years ago, financial freedom & privacy was barely on my radar.
This would have probably continued but for a handful of good humans that took the time to talk me through things.
Thanks to thinking they kicked off for me, I now think that individual access to aspects of financial freedom & privacy are necessary to a healthy society.
Why did it take so long? Well, there was a failure of adversarial imagination on my part.
And partly because if you aren't actively asking hard questions, this state of affairs will be hidden from you.
The financial system & how it is taught is set up to hide structural privacy violations & disempowerment.
I'm pretty sure my ignorance was closer to the norm than the exception.
But when you completely restrict financial privacy & freedom, you disempower people...constantly.
And it will keep eroding & blocking the exercise of other core rights.
Until this changes & awareness grows, we're stuck paying the price for it in a thousand ways.
Shoutout to @nprofile…xncl for getting & keeping the intellectual ball rolling for me. And to all the good humans that have helped me along the way since. Thank you. You know who you are.
Painting : Egon Schiele, Four Trees, 1917.

2025-03-30 03:58:03

- reply

Now to figure out what *actually better* looks like

2025-03-30 00:53:36

- reply

I hear you. I worry that a goldrush of some of the shadiest companies will happen in a blink.
Surveillance-oriented-companies love nothing more than areas where people *have to hand over data*.
And the "we need this data to keep ppl safe" fear thing is going to be a godsend.
If we aren't demanding that concerns about safeguards, limits & accountability are included in every step of the conversation now...it will be 100x harder to get them in place once big companies & lobbyists have set the terms of the game.

2025-03-29 21:56:02

Most folks don't love security theater & everyone has had a bad time at a screening checkpoint.
So, let's think for a second about hypothetical private-#TSA companies.
I'd expect them to gravitate towards AI-assigned individual risk ratings to minimize the cost of hiring & training people to interact with travelers.
To create ratings, I'd expect them to demand & consolidate invasive pools of our biometrics, web browsing, commenting, purchasing, movements & private lives.
Just don't call it a "social credit score"
You can bet they'll pivot to trying to monetize their data.
2026: We're a terminal security company
2029: We're a person rating company
Would these ratings make their way into other parts of our lives & things we want to visit?
And who exactly would stand up for us when the ratings are wrong? Or our data is shipped to foreign buyers.
Who holds #PrivateTSA companies accountable? The US doesn't have strong #privacy protections...
I'm also not optimistic about private sector security companies' ability to stop breaches. History backs me up here.
But I do expect that private-TSA companies could use lobbying to limit oversight & accountability.
That's been the history of other privacy-invasive tech companies.
So, as an airline security privatization conversation kicks off, remember that it can't just be "current thing is bad" but needs to consider what kind of future we're inviting in. https://m.primal.net/Pxhw.png

2025-03-28 20:11:09

What's your best focused work music?
I'm getting habituated to mine.
Please drop a link.

2025-03-27 17:45:15

BREAKING: more journalists targeted with #Pegasus spyware.
This time journalists in #Serbia that were investigating corruption.

2025-03-24 18:47:40

Datapoint: this administration uses Signal. Like every other administration.
Because encrypted messaging is critical infrastructure.
Remember this the next time a government demands an encryption backdoor.
https://m.primal.net/Priw.png
How did a reporter get added? Well, the use of encrypted chat is ubiquitous but not explicitly accepted, supported or discussed in most institutions.
Which means users are left to fend for themselves in how they use & understand these tools.
And are usually about 1 mistake away from self-doxxing group contents.
https://m.primal.net/Prix.png
This also left me wondering: is anyone screening these devices for mercenary spyware like Pegasus?
https://m.primal.net/PrjS.png
Experience tells me the answer is: maybe not.
Article: https://www.theatlantic.com/politics/archive/2025/03/trump-administration-accidentally-texted-me-its-war-plans/682151/

2025-03-24 17:37:37

Some of the least exploitative consumer interactions happen between individuals & small / local vendors. These have the potential for mutual trust and reciprocity + possibility for sanctions in both directions if trust is violated.*
Trust + your private information is held in a distributed way & there are some social protections for your data.
A small shop gets hurt if you stop patronizing them because they violated your trust, for example. And if you cheat your nearest grocery store and they refuse you service, this is a cost for you.
These relationships are increasingly being replaced with unidirectional information harvesting where all arrows of data sharing point to the intake pipes of a centralizing enterprise.
The more this happens, the more the power consolidates up. And payment processors are speeding the process... trying to become the intercessors in those trust dynamics.
Your data heads to companies whose incentive is to always exploit any biometric / personal information you share with them for every-profitable-thing they can think of. Collecting biometrics to validate a trusted transaction becomes...hey we now have a new identity database we can sell for mass surveillance.
The incentive will always be data disempowerment: propagate your info as widely as profitable, far outside of what you would ever want or meaningfully consent to.
The bigger the set of such data & the more centralized, the more potential for harm...
And the lower the ability for any individual that has been burned by the transaction to meaningfully sanction the entity that abused their trust/ information.
*of course there are always edge cases where the vendor is small but super wealthy/connected etc and the consumer isn't. The point is that the further we get from this, the greater the chance that the dynamic is fully unequal.#nevent1q…d2m0

2025-03-19 20:23:02

Report: Researcher's device got searched at US border.
Turned away because he expressed personal view in private about how scientists were being treated.
Seems like France is taking a dim view & speaking to the press as a signal of their displeasure https://m.primal.net/PloO.png
(Machine translated)
Original (FR): https://www.lemonde.fr/international/article/2025/03/19/etats-unis-un-chercheur-francais-refoule-pour-avoir-exprime-une-opinion-personnelle-sur-la-politique-menee-par-l-administration-trump_6583618_3210.html

2025-03-19 19:26:45

🚨NEW REPORT: first forensic confirmation of #Paragon mercenary spyware infections in #Italy...
Known targets: Activists & journalists.
We also found deployments around the world. Including ...Canada?
https://m.primal.net/Pljg.png https://m.primal.net/Plji.png
So #Paragon makes zero-click spyware marketed as better than NSO's Pegasus...
Harder to find... https://m.primal.net/Pljo.png
...And more ethical too!
This caught our attention at #Citizenlab. And we were skeptical. https://m.primal.net/Pljq.png
So.. it was time to start digging. https://m.primal.net/Pljr.png
We got a tip about a single bit of #Paragon infrastructure & my brilliant colleague Bill Marczak developed a technique to fingerprint some of the mercenary spyware infrastructure (both victim-facing & customer side) globally. https://m.primal.net/Pljv.png
So much for invisibility.
What we found startled us.
We found a bunch of apparent deployments of Paragon's mercenary spyware in places like #Australia, #Denmark, #Israel, #Cyprus #Singapore and... #Canada.
Fun. https://m.primal.net/Pljz.png
We also found interesting stuff at a datacenter in #Germany https://m.primal.net/PlkB.png
Caveats: the methodology we use only surfaces a subset of customers at a particular time.
So ...about #Canada.
My colleagues on the legal side began digging. The more they pulled, the more questions surfaced about whether the Ontario Provincial Police is rolling mercenary spyware. https://m.primal.net/PlkJ.png
While investigating, we found signs #WhatsApp was being used as a vector for infections.
We shared our analysis with Meta which had an ongoing investigation into Paragon.
They shared findings with WhatsApp which discovered & mitigated a zero-click attack.
They went public, and notified ~90 users that they believed were targeted.
https://m.primal.net/PlkM.png
WhatsApp's notifications to targets turbocharged what we all knew about #Paragon.
https://m.primal.net/Plkd.png
Cases began coming out: an investigative journalist in #Italy and sea rescue activists were among the first. Francesco Cancellato. Editor in Chief of Fanpage.it, & Luca Casarini and Dr. Giuseppe “Beppe” Caccia of Mediterranea Saving Humans
They consented to us doing a forensic analysis... https://m.primal.net/Plkc.png
Sure enough, we found traces of infection on several Androids.
We call the indicator #BIGPRETZEL & #WhatsApp confirms that they believe BIGPRETZEL is associated with #Paragon's spyware.
In the weeds a bit: Android log forensics are tricky. Logs get overwritten fast, are captured sporadically & may not go back very far. So, not finding BIGPRETZEL on a targeted phone wouldn't be enough to say it wasn't infected. In such a case, the only safe course of action for a notified Paragon target would be to presume they had been infected.
https://m.primal.net/PlkT.png
Our analysis is ongoing.
.... but There's more!
There's more! We'd been analyzing the iPhone of human rights activist David Yambio, who is focused on abuses against migrants in Libya (they are often victims of torture, trafficking, and killings) who works closely with the other targets. https://m.primal.net/Plki.png
Last year he got notified by Apple that he was targeted with sophisticated spyware.
We've forensically confirmed the infection & shared details with Apple.
https://m.primal.net/Plka.png
Apple confirms they fixed the vectors used to target him as of iOS 18.
We're not doing a full technical attribution of this novel spyware to a particular company yet. But it's not like anything we've seen.
Troublingly, timeline of David's spyware targeting lines up with when he was providing information to the International Criminal Court about torture by human traffickers in #Libya.
But there's even more spying afoot against this cluster of activists!
Luca also got a notification last February about targeting with a different kind of surveillance tech. https://m.primal.net/Plkp.png
He wasn't alone. Father Mattia Ferrari, chaplain of Luca's lifesaving organization' also got a notification.
https://m.primal.net/PllW.png
#Italy's response to the unfolding #Paragon scandal has been exceptionally chaotic. So we included a little timeline.
Denials, then admissions, then refusals to say more citing secrecy. https://m.primal.net/Plks.png
Honestly, deja vu of how Pegasus-abusing governments have handled PR...
TAKEAWAYS:
TAKEAWAY 1: you can't abuse-proof mercenary spyware. Selling just democracies won't prevent abuses. Most democracies have plenty of historic examples of surveillance abuses. Why should spyware be different?
https://m.primal.net/Plku.png
TAKEAWAY 2: #Paragon's technical tradeoffs to be less detectable didn't prevent them getting discovered.
Just made it harder.
https://m.primal.net/Plkx.png
TAKEAWAY 3: I think we're only looking at the tip the #Paragon hackberg
For example, the ~90 notification number from #WhatsApp
only represents 1 infection vector that got caught & notified.
There may be non-notified spyware victims walking around right now who were infected via a different mechanism.
In #Italy, too we also need to better understand the other surveillance technologies pointed at this cluster of people.
Finally, we gave #Paragon room to respond to a summary of our key findings.
Their US Executive Chairman, a 30+ year #CIA veteran, responded in a way that sounded very familiar to how NSO Group did PR.
https://m.primal.net/Plkz.png
1 - Say there are inaccuracies..
2- ..But refuse to specify them
3-Cite customer confidentiality as a reason to not say more.
https://m.primal.net/PllF.png
We welcome any clarifications they have now that they've read our full report.
FINAL NOTES: our #citizenlab investigations are usually big, collaborative team productions. Smart co-authors, awesome collaborators. https://m.primal.net/PllG.png
The key to nearly all our research into spyware is targets' brave choice to speak out.
And work with us to forensically analyze their devices... We are very grateful to them.
This is how we collectively get a better understanding of mercenary spyware abuses.
And journey towards accountability.
Thanks for reading! Drop questions in the replies!
READ THE FULL REPORT https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/

2025-02-10 19:07:46

Hey Hey! Update your iPhone today!
Apple just blocked an attack discovered by my Citizen Lab teammate Bill Marczak.
Allowed a bypass of Apple's USB Restricted Mode on locked devices.
Actively used by a sophisticated attacker.
Stay safe out there.
And avoid leaving your phones unattended.
https://support.apple.com/en-us/122174
https://m.primal.net/OZok.png

2025-02-10 18:43:38

Full biometric KYC for a sandwich.
Absolutely not, Jeff.
https://m.primal.net/OWgA.png

2025-02-07 18:56:37

- reply

Big. Cool.

2025-02-07 16:14:43

NEW: UK secretly demanded Apple build a backdoor into ALL encrypted iCloud accounts. https://m.primal.net/OUsQ.png
You haven't heard about this before because these orders are secret & there are typically bans on talking about them.
SHORT TERM IMPACT:
Apple will probably stop offering encrypted iCloud storage in the UK.
DETAILS:
the UK Home Secretary sent #Apple a so-called "Technical Capability Notice" which is a demand for access.
These flow from the 2016 Investigatory Powers Act (aka "Snooper's Charter") and is a mechanism for the government to *compel* companies to provide access.
ENFORCED SILENCE:
Among the more pernicious parts of this secret demand: Apple would be *FORBIDDEN* from telling users that the backdoor had been introduced into iCloud's Advanced Data Protection.
BIG PICTURE:
The public really doesn't realize it, but cloud backups of phones are constantly used for surveillance. Huge #privacy & #encryption gap.
By introducing optional Advanced Data Protection, Apple extended similar protections of device encryption to users' clouds.
So, since ADP was introduced in 2022, governments have been scheming to undermine it.
LOOKING INTO THE FUTURE:
It's only a matter of time before governments try to target Private Cloud Compute. And do so with the same secret legal tools.
REPORT:
https://www.washingtonpost.com/technology/2025/02/07/apple-encryption-backdoor-uk/

2025-01-29 22:53:06

#nostr, you just zapped my post hard enough to pay for tasty tacos.
Amazing.
P.S. Current energy reconversion: 1 sat =18 kcal
https://m.primal.net/OGpe.png
#nevent1q…8448

2025-01-29 17:34:19

No notes.
#deepseek #openai https://m.primal.net/OGSV.png

2025-01-29 03:28:20

- reply

Welcome to nostr!

2025-01-28 16:57:10

- reply

YES

2025-01-28 16:13:29

Watching journalists get censored on deepseek app
I'm glad to see the conversation about censorship in AI entering into new spheres.
Hoping that the concerns stick.
https://m.primal.net/OEcO.png

2025-01-28 04:59:24

Monday edition of *Car privacy is an absolute nightmare*:
https://m.primal.net/ODrS.png
Subaru's employee portal holds a year's worth of location data for all internet-connected cars. https://m.primal.net/ODrt.png
We know this because it was vulnerable (now fixed). You could pull a year's worth of driving just with a license plate.
https://m.primal.net/ODrn.png
Props to Sam Curry & Shubham Shah for exposing it. Pic is a years' worth of Sam's mom's #Subaru locations.
I seriously doubt any owner has a clear idea that this data is being collected on them.
But the same thing is replicated for almost every car mfr (see the #Mozilla foundation report on car privacy link)
Literally no car owner has asked for their whip to be turned into a surveillance portal.
And yet..
Car companies feel basically no pressure to do right by customers, but experience a lot of incentives to mine their movements for money.
Sidenote: same (now closed) vulnerability also enabled remote unlocks & starts and a bunch of other highly undesirable things.
Reading list:
The Subaru research: https://samcurry.net/hacking-subaru
News report on it: https://www.wired.com/story/subaru-location-tracking-vulnerabilities/
Mozilla Foundation's key investigation into car privacy: https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/

2025-01-28 04:35:49

- reply

Agreed

2025-01-28 04:13:20

- reply

Great suggestion, @nprofile…h36r is a gem

2025-01-28 00:03:13

Who on #nostr is saying interesting things about #privacy?
Help me fill out my follows!

2025-01-28 00:01:29

- reply

Maybe we need to hire a bunch of amazing marketers to help message test privacy.

2025-01-27 21:08:51

- reply

We are in the earliest days of sensing the privacy implications of incorporating #chatgpt / #deepseek et al. into our lives.
I think this period will be viewed as a time of a massive willing...but not fully witting... transfer of personal information, right down to our ways of reasoning & understanding the world...into the hands of a new set of companies & their CEOs.
The same companies that have the ambition to shape how we think.
And shape how society looks.

2025-01-27 21:00:08

It shouldn’t take a panic over Chinese AI to remind people that most companies in the business set the terms for how they use your private data.
And when you use their AI apps, you’re doing work for them, not the other way around.

2025-01-27 14:54:05

- reply

spywareland is a wild world!

2025-01-27 14:49:37

- reply

Thank you!

2025-01-27 03:17:19

- reply

Thank you @nprofile…thgr I'm excited to he here.

2025-01-27 02:59:59

- reply

UofT!

2025-01-27 00:35:35

- reply

will check it out

2025-01-26 23:56:10

- reply

oh yeah me too @npub14j6…jvl6

2025-01-26 23:55:19

- reply

hey @npub1k3v…3dmq thank you i am excited

2025-01-26 23:52:58

- reply

thank you @npub12sj…k6jg

2025-01-26 23:47:51

- reply

thank you @npub16eu…t6jc im feeling the love

2025-01-26 23:37:50

- reply

you may indeed be thinking of us. or maybe one of the dedicated helplines for activists like AccessNow

2025-01-26 23:34:21

- reply

too kind! I call us researchers and ngos collectively an accountability ecosystem and I am proud to be part of it

2025-01-26 23:30:46

- reply

Thank you brother!

2025-01-26 23:29:55

- reply

we exposed Pegasus, we dont make spyware ;)

2025-01-26 23:28:29

- reply

Glad to hear. I'm fortunate to work among so many good ppl

2025-01-26 18:35:40

- reply

Starterpacks are smart and they create all sorts of desirable network effects.
When I locate Bluesky really taking off, a big part of that was people being able to quickly recreate the kinds of information feed they were getting elsewhere by following interest starterpacks.
This also sent a signal to ppl that put a lot of effort into their posting: there's a way for you to grow & help others grow quickly.

2025-01-26 18:33:25

- reply

I'm glad you found it interesting. Love the podcast.

2025-01-26 18:27:50

- reply

thanks! I love making good trouble

2025-01-26 18:22:55

- reply

Thank you. Excited to flex my freedoms

2025-01-26 18:22:06

- reply

Thank you! Excited to be sharing here.

2025-01-26 18:21:40

- reply

It helps us understand what the communities we serve face every day.

2025-01-26 18:20:20

- reply

Thank you. I'm grateful to be able to do it. And have so many smart collaborators.

2025-01-26 18:18:53

- reply

as a large language model i cannot...

2025-01-26 18:18:27

- reply

Thank you. I'm fired up.

2025-01-26 18:18:05

- reply

Thank you for the good energy!

2025-01-26 18:17:46

- reply

Glad you enjoyed it! Which one?

2025-01-26 18:15:59

- reply

ONWARDS

2025-01-26 17:32:32

- reply

What a nice thing to say, hi @nprofile…hppf !

2025-01-26 16:53:05

Hi everyone, I'm JSR.
Me & my colleagues chase government hacking & censorship of dissidents & activists.
Heard of Pegasus spyware? Then you know about our work.
I'm part of the Citizen Lab, a ferociously independent research group based at the University of Toronto.
We try to 🥊punch above our weight.
Your device has probably gotten security updates that flowed from our collaborative investigations.
Craziest story? When we punked a team of mercenary🕵️ spies sent to target our research. https://www.youtube.com/watch?v=Z8IrU_jvnFk
I'm so proud of my colleagues & talented collaborators in the fight to serve fat helpings of good trouble & accountability.
All the good research I've worked on has been a team production... But everything I say here, especially the typos & bad ideas are100% mine.

2025-01-26 16:16:33

This. No accident that legacy platforms slide towards restricting access by researchers.
After the acquisition of Twitter, an underreported play was freezing out any meaningful research into manipulation by gatekeeping the API & firehose.
So users are left with "this feels weird" & few ways to know more.
#nevent1q…st0f

2025-01-26 05:21:59

- reply

Indeed so. I should have included the link https://www.bbc.com/news/articles/c5y3pdp099zo

2025-01-25 19:08:36

- reply

Good question. Imagine your user never tells you their age or gender or feelings, but you use big pools of data & some ML to make a guess that it is an underage girl.
Then sell targeting of ads on them based on these inferences. And maybe a few others, like about the depression and insecurity she is struggling with & might be predisposed to buy.
It gets even creepier when the inferring is about finding signals for non-users and constructing shadow profiles. E.g. *your* kid.
https://m.primal.net/Nzxb.png https://m.primal.net/Nzxf.png

2025-01-25 19:00:07

The official instinct to solve all problems by application of surveillance dystopia is a feature, not a bug.
https://m.primal.net/Nzwy.png https://m.primal.net/NzxA.png

2025-01-25 02:59:50

- reply

Indeed this is usually true.
For Cyd, they have a pretty logical pricing model, great privacy policy, are open source & I can personally vouch for the integrity of the lead dev. https://m.primal.net/NyvW.png

2025-01-25 02:10:59

- reply

Thanks, it feels good

2025-01-25 01:57:50

- reply

Been experimenting with local R1 distills and how they answer logic problems.
The deductive-flavored reasoning is fascinating...
https://m.primal.net/Nyrf.png
But the political limitations are pretty clear too. https://m.primal.net/NyrY.png
In some cases you get a limitation when you talk about a sensitive topic directly.
In others, it will helpfully show *thinking about censorship that contains the censorship*
https://m.primal.net/Nyrl.png

2025-01-25 00:51:23

- reply

Accurate. I think we are only in the earliest stages of understanding just how much harm they are capable of causing.

2025-01-25 00:50:04

- reply

Yeah. The distinction between realtime censorship of outputs and model-generated propaganda is fascinating. I'm especially interested in the dynamic of models like R1 that can be used to train derivative models...
Who knows where those tendrils of propaganda will eventually wind up...

2025-01-25 00:36:50

- reply

It's really more of an *is anyone not trying to hack us?* scenario in my experience.
We got here because doing so has been largely a consequence-free zone

2025-01-24 23:37:33

- reply

Here's what I found.
https://primal.net/e/note1r62wf5rn7gy3pre7g06c0swqf69yledrqudp8el3y9rn2z2c8kdsqhgy90

2025-01-24 21:00:58

- reply

If you run a local version of an R1 derivative model it does not happen.
Although those models have interesting answers about Taiwan. https://m.primal.net/NyXZ.png
And if you try to spring the same question in a dialogue about something else, you get a bit more verbose a response.
Pay attention to the reasoning.
https://m.primal.net/NyXe.png

2025-01-24 20:45:57

NEW: the US is seeking extradition of an Israeli private spy over sprawling hack & leak operations against 🇺🇸American nonprofits.
Let me tell you a story... https://m.primal.net/NyUq.png
Amit Forlit's alleged customer: a US lobbying firm named DCI Group...representing oil & gas giant ExxonMobil.
https://m.primal.net/NyUc.png
IT BEGINS
The criminal case was triggered back in 2018, when US-based nonprofits targeted by hackers whom we'd been working with requested that we notify the authorities.
We'd found an absolute raft of targeting and attributed the fingers-on-keyboards to an Indian hack-for-hire operation.
THE TARGETS
Targets ranged from environmental orgs to net neutrality advocates , everyone that asked questions about massive financial fraud by payment processor WireCard & so many more.
https://m.primal.net/NyVt.png Our friends at EFF also spotted the phishing against net neutrality orgs & reported on it, we later attributed it to the Indian group.
https://m.primal.net/NyVG.png
TIME TO NAME & SHAME
We published alongside Reuters, naming the Indian group (BellTrox) back in 2020. https://m.primal.net/NyWE.png
TWO ISRAELI PRIVATE SPIES...
Fast forward to today's efforts to extradite Amit Forlit, who was arrested at Heathrow last year.
He's actually the *second Israeli private investigator* charged in this massive hacking scheme.
The first, Aviram Azari, was arrested in 2019 on his way to Disney World, convicted & is serving out his sentence. https://m.primal.net/NyVM.png
The US accuses Forlit of serving as a go-between for Indian hack-for-hire groups.. and a global client list. https://m.primal.net/NyUw.png
The US doesn't name the lobbying firm or the big oil and gas company in their filing.....but Forlit's own lawyer helpfully filled in the details, as reported by Reuters. https://m.primal.net/NyUf.png
THE SCHEME
The operation targeting environmental groups is pretty wild, and when we timelined phishing attempts against their advocacy strategies. The targeting was smart & super-aware of relationships between the targets. https://m.primal.net/NyUr.png
When hacking is corporate, they make memos.
https://m.primal.net/NyUx.png https://m.primal.net/NyVA.png
And email about them.
"Why the *** was he sending e mails what a dumb arse"
https://m.primal.net/NyUy.png
Epic line: The kind of message that prosecutors of...
TAKEAWAY
Today, many legal fights, including attacks on nonprofits & civil liberties groups, have a secret undercurrent of hacking-for-hire. https://m.primal.net/NyWd.png
The powerful interests that commission the hacking & benefit from the often-manipulated 'leaks' escape consequences.
But if you are around these issues, you may get targeted too.
This case goes further up the chain than any before. We'll see just how high, but it is great to see some consequence brought to this shady ecosystem.
I'll keep folks here updated.
Reading list:
Our Citizen lab investigation:https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/
EFF report on targeting of net neutrality orgs: https://www.eff.org/deeplinks/2017/09/phish-future
Report on Forlit hearing: https://www.reuters.com/world/israeli-private-eye-wanted-us-over-alleged-hacking-exxon-lobbyist-lawyer-says-2025-01-22/
Aviram conviction story: https://www.reuters.com/technology/cybersecurity/israeli-private-detective-sentenced-us-6-23-years-hacker-for-hire-scheme-2023-11-16/
Today, many legal fights, including attacks on nonprofits, have a secret undercurrent of hacking.

2025-01-23 20:51:05

- reply

A lot of people want to.
Conceptually.
But the practicalities and fear of the first step are a lot of friction.
Key is to identify people that are like this and help them reduce the friction & fear & see their way to joining this exciting world.

2025-01-23 18:42:42

- reply

Extreme darkness down this path

2025-01-23 18:41:19

- reply

Working to convert it to run on seed oil.

2025-01-23 18:40:13

- reply

My dream: an open community with a wiki per model showing how to do this. Something you could do yourself as a DIY or hand to your mechanic.

2025-01-23 17:37:13

- reply

It runs on coal.

2025-01-23 17:36:33

- reply

I just got zaps for the first time last night 😉

2025-01-23 16:28:06

Wait, people can support me in real value, not just magic internet points that are revokable without notice?
Zaps just blew my mind.

2025-01-23 15:38:25

- reply

Too kind, try again?

2025-01-23 15:35:58

Europe is preparing for another assault on encryption.
https://m.primal.net/NwXN.png

2025-01-23 05:11:57

- reply

having spent some time unscientifically but persistently comparing LLM censorship in response to the same prompts with CN and US models I'd say that some CN models I've explored have galaxies of off limits outputs. however they are different. so you need to ask the kinds of questions that get these answers. Which means you need to focus on censored themes in China. Like the five poisons...
https://www.businessinsider.com/chinas-spy-agencies-five-poisons-taiwan-tibet-uighur-democracy-2023-8

2025-01-23 05:00:16

- reply

Too kind! Thank you

2025-01-23 04:59:36

- reply

What a nice thing to say! Thank you @npub1trr…hdpu

2025-01-23 04:51:58

- reply

Orwell would be proud

2025-01-22 18:45:56

We need #encryption backdoors to 'enforce' democracy says Europol chief.
Says anonymity "not a fundamental right"
https://m.primal.net/NvDQ.png
I disagree.
#Anonymity is part of the bedrock of protecting healthy dissent.
Forcing total government access to private communications lays the technical groundwork for undermining democracy.
https://m.primal.net/NvDk.png
But here we are. It's a new year, so cops & governments are taking fresh swings at encryption.
Only the scare tactics change.
Welcome to a new, cynical chapter in the fight to protect privacy.
https://m.primal.net/NvDq.png
Demanding them... when the worst recent national security breaches in the US happened... when #China hacked government-mandated backdoors... is also absurd.
There's every reason to believe something similar may have happened in #Europe , we just don't know it yet.
Shortsighted and cynical stuff.
Story: https://www.ft.com/content/1e6a600d-8620-4ed6-a4cd-5c454d6247ba

2025-01-05 03:17:08

Heard about a big breach over at Volkswagen?
https://m.primal.net/NScA.png
Here's whats going on. Every major car company collects your driving data. And everything I've learned about this subject makes me want to go into the dash and start pulling wires out.
100% of car companies collect unnecessary data
84% share/sell it
92% provide insufficient control over data.
(Data: Mozilla Foundation investigation)
https://m.primal.net/NSad.png
Most pour it into the shady data-broker ecosystem.
Where it goes to god-knows who. And represents a really exciting stream of surveillance data for governments and everybody else.
https://m.primal.net/NSam.png
Most also turn it over to governments.
And insurance companies.
https://m.primal.net/NSbI.png
We got here because, in search of new revenue streams, these car mfrs turned to mining owners for movement data.
Their disrespect for your #privacy is a through-line, and is reflected in just how sloppy they can be about protecting it.
https://m.primal.net/NSar.png
Unsecured AWS? Ugh. But this is just the tip of the iceberg.
This massive data exposure happens to be Volkswagen, but the story tracks for every major car company.
https://m.primal.net/NScW.png
When companies do offer some sort of opt-out... your car might break. Or so they warn you.
https://m.primal.net/NSbD.png
We are still in earliest days of people investigating and pointing this out, but things are bound to get worse with electronic vehicles.
Reading list:
Mozilla Foundation's key investigation: https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/
CSO Oline report on VW:
https://www.csoonline.com/article/3631055/volkswagen-massive-data-leak-caused-by-a-failure-to-secure-aws-credentials.html
Nissan breach report:
https://www.industryweek.com/technology-and-iiot/article/21258350/nissan-north-america-reports-consumer-data-breach

2025-01-01 01:26:41

Happy New Years.
Friends & strangers fighting good fights for #freedom, thank you.
May you sleep easy... the autocrats sleep queasy
...and the spirit of resistance to tyranny keep burning bright.

2024-12-31 00:01:09

NEW: #China gov hackers breached #TreasuryDept
Not a ton of clarity on what was taken yet.
Sounds like it went like this:
STEP 1:Targeted Treasury security vendor #BeyondTrust
STEP 2: Stole BT's key for support platform
STEP3: tech support platform becomes backdoor on #Treasury machines
Ouch.
https://m.primal.net/NLzO.png
Analogy-ish: burglar breaks into plumber's office & steals master keys to the buildings they service...
Given BeyondTrust's big client list, presumably with many juicy targets for the #PRC it makes you wonder who else may have been targeted.
https://m.primal.net/NLzP.png
Talented reporting crew of Raphael Satter & AJ Vicens point to a recent posting by BeyondTrust about an incident that identified a series of vulnerabilities in their remote support tools.
https://m.primal.net/NLzW.png
Sure sounds like this is it...
https://m.primal.net/NLzc.png
Tom Hegel rightly points out the longstanding pattern of hackers from #China targeting trusted 3rd party platforms (hello cybersecurity, identity & authentication vendors!) to go after big targets.
https://m.primal.net/NLzY.png
Pulling back a bit, this is a good reminder that #cybersecurity for most institutions today is heavy with services from 3rd party vendors.
Which means a complex layer of threat for defenders who also have to worry about the first order problems the #infosec vendor products seek to address...
Good times for the gov-backed #hacker class.
Reuters: https://www.reuters.com/technology/cybersecurity/us-treasurys-workstations-hacked-cyberattack-by-china-afp-reports-2024-12-30/
Beyond Trust: https://www.beyondtrust.com/remote-support-saas-service-security-investigation

2024-12-23 16:06:07

Predators are targeting your parents.
The volume of scam phone calls targeting elderly people in the US is insane.
If you've visited an aging person, you know what I'm talking about.
If not, just ask any retired person you know.
Several calls a day on their landline isn't out of the ordinary.
Every time the phone rings there's a chance that the person faces a risk of wiping out their savings.
Foreign scam call centers are running on an industrial scale.
The situation is like an opportunistic infection.
It is a symptom showing that the US phone system's defenses aren't up to the task.
With increasingly clever AI/ deepfake voices & automation, the #Scam call problem is set to get worse.
Last year we got a hearing on phone scamming of seniors by
the Senate Aging Committee.
We need many more.
We need lawmaking with teeth.
And we need accountability at every level.
https://www.youtube.com/watch?v=7CMhzgQdz_I

2024-12-23 03:50:10

VPN advertising is the most common source of security misinformation I encounter.
The industry is a scourge.

2024-12-21 05:30:54

- reply

6/ The victims in the 2019 hack had been targeted with a simple missed video call exploit.
https://m.primal.net/NCKU.png
No action required, and once-infected, the call log would typically be deleted.
https://m.primal.net/NCKT.png
We at Citizen Lab volunteered help investigate the target list and try find journalists, dissidents, and human rights defenders.
We found a lot.
And plenty of unexpected pockets of repression. Like the targeting dissident members of the clergy in Togo. https://m.primal.net/NCKX.png
https://m.primal.net/NCKW.png

2024-12-21 05:27:01

- reply

5/ In the years after #WhatsApp sued NSO, much happened.
More court cases were filed against the #Pegasus spyware maker.
And in November 2021 NSO got hit with US sanctions.
But thankfully, WhatsApp stuck to the case for five years even as NSO seems to have tried every-available-trick to slow-roll & delay.
To some, it looked a lot NSO was being arrogant.
To others, like a company that truly held itself above any law...
Ultimately NSO's legal tactics seem to have gone over badly with the judge, resulting in today's summary judgement.

2024-12-21 05:25:39

- reply

4/ WhatsApp suing NSO Group was a huge deal at the time.
We at Citizen Lab & our peers in civil society had been investigating & surfacing a pile of #Pegasus abuses since 2016. Journalists, dissidents, truth-tellers, scientists, lawyers..
But nobody was taking action & NSO was flying high.
The ultimate digitally-enabled playground bully.
For years, governments seemed content to let the mercenary spyware industry live in the shadows...
NSO's valuation & client list ballooned.
Meanwhile, NSO constantly misled reporters, nurtured disinformation about researchers & blamed spyware victims..
And then they got sued by a very big company that chose to stick up for its users & security.
Suddenly, NSO wasn't on such sure footing. https://m.primal.net/NCKK.png
WhatsApp had their own factual, technical analyses, and plenty of resources
https://m.primal.net/NCKN.png
Suddenly they couldn't just claim that a few researchers were out to get them.
https://m.primal.net/NCKF.png https://m.primal.net/NCKH.png https://m.primal.net/NCKI.png https://m.primal.net/NCKJ.png

2024-12-21 05:20:49

- reply

3/ Today, the court decided that enough was enough with NSO's gambits & efforts to hide source code.
Judge Hamilton granted #WhatsApp 's motion for summary judgement against the #Pegasus spyware maker.
The judge finds NSO's hacking violated the federal Computer Fraud & Abuse Act (#CFAA), California state anti-fraud law #CDFA, and was a breach of contract.
What happens next? The trial proceeds only on the issue of resolving damages stemming from NSO's hacking. https://m.primal.net/NCJv.png
Order: https://storage.courtlistener.com/recap/gov.uscourts.cand.350613/gov.uscourts.cand.350613.494.0.pdf

2024-12-21 05:19:14

- reply

2/ In 2019, 1,400 WhatsApp users were targeted with #Pegasus over a 2 week period alone. https://m.primal.net/NCJp.png
WhatsApp did the right thing & sued NSO Group.
NSO has spent 5 years trying to claim that they are above the law.
And engaged in all sorts of maneuvering.
With this order, the music stopped and NSO is now without a chair. https://m.primal.net/NCJq.png

2024-12-21 05:18:08

BREAKING: NSO Group liable for #Pegasus hacking of #WhatsApp
users.
Big win for #spyware victims.
Big loss for NSO.
Bad time to be a spyware company.
Landmark case. Huge implications.
Here's the story1/
https://m.primal.net/NCJj.png https://m.primal.net/NCJl.png https://m.primal.net/NCJm.png https://m.primal.net/NCJn.png

2024-12-20 15:46:34

- reply

3/ CISA's guidance for Android starts from the unavoidable fact that many Android manufacturers truly don't respect users security or privacy.
https://m.primal.net/NBjQ.png
So, ✅pick a company that won't leave you insecure after 2-3 years.
https://m.primal.net/NBjS.png
Other good guidance here includes...
✅ Only use RCS with end-to-end encryption
✅ Using Android Private DNS
✅ Use Enhanced Protection for Safe Browsing
✅ Google Play Protect
✅ Manage permissions.

2024-12-20 15:44:24

- reply

2/ So CISA's top recommendation for Apple users is: ✅ enable #LockdownMode
https://m.primal.net/NBjK.png
It's also my top guidance for high-risk #iPhone users..
Because as researchers tracking sophisticated threats we see Lockdown Mode blunt advanced attacks...
Here's how to turn it on:
https://m.primal.net/NBjL.png
Other solid guidance:
✅Protect your DNS
✅Disable fallback to SMS
✅Enroll in iCloud Private Relay
✅Trim App permissions.
Also typo above: that's Cybersecurity and Infrastructure Security Agency 🙃

2024-12-20 15:38:16

USE ONLY END-TO-END ENCRYPTED COMMS says 🇺🇸CISA*
Yes!
End-to-end encryption is critical infrastructure for a safe society.
https://m.primal.net/NBiv.png
They have other mobile security guidance, but first... how did we get here?
Well we've come to a a point predicted by security & privacy people for a long time: the brittleness of our infrastructure security is such that even government agencies' guidances says use end-to-end encryption.
Because our networks are so penetrated & vulnerable that this is the only reliable way to protect Americans inside the US from ...foreign interception.
Wild time to be alive.
*US Cybersecurity and Infrastructure Agency

2024-12-20 15:25:12

The US is considering banning TP-LINK routers.
https://m.primal.net/NBiO.png
Company has the majority market share in US for homes & small biz. https://m.primal.net/NBhr.png
Concerns stem from Chinese-gov linked attackers repeatedly leveraging vulnerabilities.. and the company not taking much action.
The threat from TP-Link is real. Just look at how CovertNetwork-1658 runs a massive password-spraying operation from compromised routers. https://m.primal.net/NBhx.png https://m.primal.net/NBhv.png
On the other hand, not clear that banning router companies 1 by 1 is going to solve the other half of the problem.
Which, narrowly, is that most SOHO routers are just very vulnerable and used for years without updates. Many more even than random end-of-life Androids etc. And threat actors around the world are already exploiting this. Doesn't matter their country-of-origin, the threat is real.
More broadly, the issue is that accountability & oversight in the US around catastrophically privacy violating & insecure technology is a joke....
So that, as usual, the consequences flow to vulnerable users & systems...
Story: https://www.wsj.com/politics/national-security/us-ban-china-router-tp-link-systems-7d7507e6?st=oP8Bk2&reflink=desktopwebshare_permalink