This week's surveillance report covers Meta's hidden facial recognition code on millions of devices.
Microsoft repos have been weaponized against AI users.
The UK's push to scan every single device with Signal having to respond.
A good and bad news week for state privacy laws in the US.
And the usual data breaches, threats, and open source updates.
Welcome everybody to the Techlore surveillance report.
your essential weekly tech news, delivering deep analysis on the latest threats to your security,
privacy, and digital freedom. And of course, empowering you to reclaim, control, and defend
your right. I'm Henry, and we got a big week this week, so let's not waste any time. Just a very
quick announcement before we get into the meta story is that we're going to be traveling and
decided not to try to force this. We're not going to have a surveillance report next week,
and there's also going to be no live stream next week. We're going to have clips that we're going
to be rolling out. We have other content that we'll still be publishing, but we are skipping a
week of this podcast and then we're going to be returning in two weeks. Without further ado,
let's cover the company that I always got to make sure I maintain my composure when I talk about
them because it can be quite infuriating, but this has to do with Meta. This is supposedly inside of
the Meta AI app. It's a dedicated app for Meta AI and they embedded this unreleased face recognition
system into the app onto more than 50 million phones. Now, if you're curious what this is
supposed to do. It is as scary as it could possibly sound. Essentially, this feature was
designed, and this is quoting Ars, to convert faces captured by their glasses into unique
biometric signatures, commonly known as face prints, and then compare them against the database of
face prints stored on the user's device. Wired also found that faces the system failed to recognize
were cropped, indexed, and stored locally for future processing. And that name name tag was actually
still referenced in several code libraries the day that Wired came forward with the story,
and made it public to the world.
But then Friday's release includes none of them.
So now they're trying to essentially cover up the fact that this happened.
I think the best part with any meta story is the kind of response,
sometimes lack thereof.
Meta pretty much came forward and said,
this feature is purely exploratory,
adding no final decision has been made on what to do here, if anything.
I find that funny because the feature was referenced in public versions of an app
that anybody could download and was on 50 million devices.
So at least to me, if I was a software development company, I knew what the hell I was doing.
If it was actually exploratory, I wouldn't be embedding it on their devices yet because I wouldn't be putting experimental software that I still don't know if I want my users to be using on their devices because I think that's a complete invasion of trust, privacy, security, just common sense.
Or they're just straight up lying and they are trying to roll this out.
I guess time will tell which one it is.
Either of them just perfectly align with how Meta functions as a company.
The best part to the same person from Meta came forward and said that they can't answer questions about how the system would work because, quote, the feature doesn't exist.
Meta's CTO even said the reporting was incredibly misleading and absolutely dishonest.
Meta declined to answer 10 questions that Wired posed before publishing on Thursday, including whether it had already created a database of face profiles, how long the app retains photographs and biometric data, and whether that data would ever be sent back to Meta's servers.
So they never actually responded to those questions before Wired came forward.
So I don't know how much Meta can say it was misleading or dishonest, you know, reporting
when Wired, first off, seems like they covered everything truthfully and was factual about
it.
And they literally asked Meta for their opinion and they didn't respond.
And now they're mad about the coverage.
It's like, dude, cry me a river.
Now, I actually made a video about this not that long ago where I talked about the creepiness
of these glasses.
Somebody actually bought a pair of these Meta Ray-Ban AI glasses.
and they started, pretty much the headline was quite interesting because they said,
I started to feel like a creep myself.
And apparently a common term that's thrown around on the internet for them is the pervert glasses
and how easy it is to spy on people.
They don't think twice about it.
It blends in.
And so, and even then they were kind of talking about Metta's intentions of rolling this out
to have actual facial recognition.
It's something that they've announced as something they might want to do in the future.
And of course, this is a complete privacy nightmare.
Imagine someone that you don't even know is wearing glasses,
is walking around the street and essentially just trying to profile people around them.
And actually, people have already started to start running third-party code on these glasses
to make that functionality happen.
So whether or not Meta chooses to do it,
they've already put out the hardware to make this possible for people.
They don't seem to care about controlling that in any way.
In fact, they want a part of that action.
That is eventually what they probably want to do.
And this is their first step in doing so.
But don't worry.
It's completely misleading reporting.
It's completely dishonest.
We're overreacting.
whatever else the meta people are going to think.
I think this company, again, I go back to this.
It is just such a rotten company.
I mean, they have absolutely zero ethics.
It is all about money.
It's all about chasing what the next big thing is.
And so I just, I beg all of you,
if you know someone who's thinking about buying these glasses,
kindly educate them about the privacy implications,
educate them about how this is a lot of trust
they have to hand a company like Meta.
And they're going to do things the sloppiest possible way
just so they can get there first,
because that's the only potential advantage they're ever going to have by doing these things.
Don't hop on this. There are going to be better options someday if this actually is something
worth paying attention to. I actually really liked some of the comments on Ars Technica. I'll read a
few out. This company can't be trusted full stop. They need to be erased from the history books,
and steps need to be taken to ensure it cannot happen again. Death to all things meta. The whole
smart glasses product from them is creepy and deserves no buyers. I can't understand people
who purchase things from this company.
So yeah, lying liars tell lies.
I think that's a good way to finish that one.
Coming up, we have the UK ultimatum
to scan all content on devices.
And Signal actually did a formal response to that.
We have some good and bad news
between two different states in the US.
And we also have the SEC
that wants to kill burner phones.
It is a crazy week.
But before then, we have Microsoft,
who's had a very interesting week.
So we're going to start here that for the second time in weeks,
Microsoft has packages that are laced with credential stealers.
So these were 73 packages that ran self-replicating stealers
as soon as they're opened by an AI agent.
So that original attack that happened in mid-May,
which had to do with some Python SDK and PyPy,
but that actually involved an account takeover of a Microsoft GitHub account.
So that account was compromised,
and that's how they were able to essentially push that update.
It was that same exact account that was used for this new compromise.
You know, ours covers and says the explanation for this double compromise isn't currently known.
It may mean that Microsoft failed to fully change credentials for the account.
It may also be the result of an unknown package run on a Microsoft developer machine that stole the new credentials.
Microsoft isn't providing details at the moment.
Now, these packages executed payloads that are designed to pretty much recap it.
They are supposed to steal things from password managers.
They steal keys from developers.
It's not good.
And it even spreads laterally through cloud infrastructure to infect other developer machines.
And so if you are in any way using any kind of these tools, this is something you need
to look into.
It's pretty serious.
And it's actually called the miasma worm, if you want to know the actual name of the
malware.
And if you are using any of these tools at all, you should 100% look into the show notes.
This happened on June 5th, and it was contained within 105 seconds.
And so it's unlikely this impacts any of you, but this is 100% worth digging into because,
you know, you might have just got the wrong update or the wrong piece of software at the
wrong time.
And that might just be missing something here because there was a security engineer who
came forward and said that this June 5th incident appeared to be part of a malware campaign
that infected 32 of Red Hat's NPM packages.
And so essentially they pivoted from those NPM packages to Microsoft resources on GitHub.
To me, when I read that, it contradicts a little bit the story and what they're saying in Arse, which is that it was the same compromise attack, which seems to point to some compromise on a developer's machine.
These things aren't inherently contradictory.
It's just the way they're presented to me don't seem like the same story.
And so I actually do hope we get a few more answers on what's going on here because I'm confused reading this coverage.
The real takeaway from these stories is that if you are using any kind of new technology, if you're using AI, if you're downloading things, you're ahead of the time, you are open to more of these risks. And this is a huge, huge area right now with a lot of attack surface and people are really targeting those kinds of developers. So just be on the lookout. This is going to keep happening.
All right, coming soon, we have some states in the U.S. which has some good news and some bad news.
And we have the FCC federally who wants to kill burner phones.
But before we get there, we have the U.K.'s ultimatum to scan all content on all U.K. devices.
So the U.K. has been going on this absolute rampage in the last year of just throwing surveillance at every possible digital problem and thinking it's going to solve the issues.
They think, oh, you know, kids are suffering with issues online.
Let's just surveil everything.
Oh, big tech companies are influencing everything in a negative way.
Let's just throw surveillance at it.
Our economy is not doing very good.
Let's throw surveillance at it.
So it's quite concerning when I see, you know, such a movement towards all of this surveillance
technology when there's very little evidence to actually back it up.
And I think that especially this child stuff is quite concerning, the age verification,
the propositions to ban things like VPNs.
It is absolutely crazy.
Now, the prime minister said tech companies must activate nudity detection algorithms or
other technical solutions on smartphones and tablets to prevent users taking photos or
sharing images of genitalia unless they are verified as adults.
Now, I don't think anyone is going to reject this overall premise, but like everything else
I've talked about, they are refusing to acknowledge the actual technical limitations of what makes
that very hard to do.
In order to actually prevent that from happening, you have to verify everybody's identity and
tie that to their device.
which is obviously a privacy concern.
And no one has actually put forward
a really solid way of fixing this problem.
The worst part is, again, it's an ultimatum.
So they say if businesses do not comply within three months,
legislation will be brought forward
requiring the protection to be added to all phones in the UK.
I think encryption is actually part of the protection for these kids.
I think giving kids safe spaces where they aren't being surveilled,
where it's hard for people to access them,
where they're only there with their trusted friends and family
is a necessary thing to keep kids safe as well.
Now, in light of this, Signal did come forward
and, you know, Signal, the encrypted messenger.
We like them.
But they put out a statement
on the UK's latest threat to privacy.
And you guys should all read it.
It's very quick.
It's literally a single page.
It's pretty much them just coming forward
and saying that this proposal
will not keep children safe.
Child safety looks like well-funded education,
robust social services,
and meaningful guardrails
on the very AI technologies and platforms.
the current government is eagerly courting.
And I think that is the most ironic part about this.
What the UK government wants instead
is invisible surveillance infrastructure
switched on by default
and potentially rushed into law under cynical pretexts.
All of this with scant care
for the actual needs of the children
they claim to be protecting
or the horrifying and far-ranging consequences
that will ensue in practice.
So again, I think they somehow compiled everything
into one paragraph very nicely.
So good on Signal for coming forward.
And I'll be keeping up to date with this story
So stay subscribed and you guys will see it in future episodes.
Not next week, but the week after.
All right, coming soon, we have good and bad news in the US from two different states.
And we have the FCC wanting to kill burner phones, but we actually have a new sponsor
called Davaic.
I think that's how you say it.
When somebody says location history app, every instinct in my body says to run away from
it as fast as I can.
But here's the thing.
Before I got into privacy, I actually really used to like Google Timeline.
And there were some really fun benefits before I understood the privacy implication.
For most people, the only way to get that functionality is to be using a big tech service.
But Davaic is the version where you actually get to keep it.
It's an open source, optionally self-hosted location history app.
So it puts everything in your court.
Basically, Google Timeline, except the map belongs to you as well as all the data.
You can import your existing Google data or data from other platforms as well.
And then you just get to enjoy it.
You can scroll back through a single day, replay the exact route you took,
and light up every country and city that you've visited.
It's also great for traveling to remember important landmarks.
And of course, as an athlete, I actually save my own runs that are my favorite runs and also
my races.
And so I can track where I run all around the world.
And so that's another great use case for this technology.
Pretty much if you like to touch grass and you're an adventurer, but you also don't want
the typical drawbacks that come along with using a service like Google Timeline, you can
self-host Davaik for free, or you can grab the hosted version down in the podcast or
the YouTube video show notes at D-A-W-A-R-I-C-H dot app slash techlor. The code techlor gets you
20% off your first year, and it's an amazing service that you should go try out. And I definitely
recommend to people in their life who are still using Google Timeline, get them off of that stuff.
And now let's get back into the show.
So we have the FCC coming soon that wants to kill burner phones, but before then we have good and
And we're going to start with the good news.
The good news is that Massachusetts has voted to pass new privacy rights bill that bans the sale of precise location data.
This is absolutely awesome.
It was actually unanimous with 146 people voting in favor and zero voting against it.
This blocks the sharing or sale of sensitive information without explicit consent.
It also includes biometrics, precise geolocation data, and other markers about religion, immigration status, and sexual orientation.
I get a lot of people asking and a lot of comments from people saying that regulation isn't going to fix the privacy concerns.
And I overall pretty much agree with that.
But the problem is if we don't have some laws that give people rights, they have nothing to actually fall back on.
They don't have rights.
So it's a bit of a problem.
I think they're a major step forward in just bumping up the baseline so that companies can't just do things without consequences.
It means that when something happens to you, you actually have rights that you can lean on to actually hold somebody else accountable.
So I don't think this is going to solve the data broker industry overnight.
I'm not delusional, and I don't think many people who are pushing for this think that either.
I think what's going to happen, though, is that companies need to think twice.
They need to go through some kind of hurdles in order to take data they would have been able to take easier beforehand.
and when something actually does go wrong,
you have a few more avenues that you can pursue
to make sure it gets done properly.
So I'm giving you claps over there in Massachusetts.
You're joining many other states who now have this,
and I would love to see something like this
pushed out federally,
and I hope to see all of these strengthened over time,
not watered down.
That is also a concern I have.
Now the bad news.
So Apple is, well, I guess this deserves
a little bit of context.
So Texas came forward, and Texas was like,
We're the freedom state, so we're going to require everybody to be age verified on their Apple and Google devices.
Now, yes, this means that Apple will need to confirm every user's age when a person creates an Apple account.
And apparently Tim Cook attempted to persuade the Texas governor to veto, but they went ahead and signed it into law.
Anyway, so the real update here is that Apple is formally bringing this to Texas as SB2420 takes effect on June 4th.
So this should have supposedly already happened.
If any of you are based in Texas, let me know what it was like.
It's actually really helpful.
I'm not based in Texas, so I can't see exactly what this looks like on an Apple device.
And so if any of you are based in Texas and you happen to be on YouTube or Spotify and
you can leave a comment, it actually is quite helpful.
And I'd love to hear how that experience has been for you.
The court still need to determine, this is from the article, the constitutionality, that's
a good word, of SB 2420 and whether the state has the authority to impose age verification
requirements on app marketplaces.
Yeah, and the reason for that is because they temporarily stayed the injunction, which still
allows the law to go into effect, but they apparently can still dish this out. I guess,
you know, this is something that we can still advocate for. We can still make our voices heard,
especially if you're in Texas, contact your politicians. This is a big thing to get involved
about. So get involved if you're in Texas. If you're not in Texas, you should still be contacting
your politicians often about what you're passionate about in a digital rights space and let them know
what you like and don't like, especially if it's relevant to something happening to you locally.
Those are the two updates, but now let's go federal.
No one likes robocallers.
Nobody likes child abuse.
Nobody likes all these problems.
But let's also just find the most lazy way to deal with it.
Pretty much the way that they want to stop robocalls
is to just ban burner phones and force U.S. consumers
to hand over more data to telecommunications companies,
which are notoriously some of the least trustworthy companies out there on the market.
These are people who collect your SMS, all your messages you send.
They collect your social security number.
They leak your social security number through data breaches.
They collect information about you, your family, who you contact,
all of your web traffic, your DNS queries.
These are literally some of the least trustworthy people
that are possibly out there in the tech industry.
And now, just like we're doing with children, we're putting more power in their court.
We're asking Apple when it comes to children and Google to now be the gatekeepers of child safety when we ask them to roll out features to keep the children safe.
Same thing here.
We're asking now the telecommunications companies to be in charge of themselves to navigate a problem they haven't been able to solve yet.
By now just making everything worse for everybody.
I find this infuriating and I think people should be angry about this.
Because it's like, why are you putting more power and trust into the people that literally
haven't been able to figure this out and have been part of the problem this whole time?
Now, the good news is that the FCC's proceeding is more about soliciting public and industry
input on the new rules.
They say, quote, would requiring the collection of this information help cut down on illegal
calls, they ask.
What privacy concerns may arise from such a collection of personally identifiable information
and how can we mitigate them?
Now, I will say that's actually a very big step forward to actually have one of these
organizations come forward and actually acknowledge the elephant in the room and say,
how can we help mitigate that is genuinely really good. It doesn't take away from the concerns. And
I'm still not convinced that this is actually gone. But the fact they even came forward and
asked those questions is a million times better than anything the UK has been doing, right? Because
the UK is just like, these aren't concerns. You don't care about child safety. We're just going
to buckle down and we're just going to ignore all the technical problems of everything we're trying
to propose. This is how it's going to work. Otherwise, get out of here or we're going to
regulate you. Literally, I would argue that the data broker industry and the fact that your
information is sold freely in this surveillance economy is probably actually an easier thing.
Well, I don't want to say easier because it involves real work from these politicians, but
that is actually something that would probably prevent a lot of these robocallers. Because I
doubt these robocallers just randomly try different numbers on their phone and hope they reach you.
They have your information because of the data broker industry that is allowed to flourish
because there's absolutely nothing stopping them from doing so.
All of you listening, the FCC is accepting public comments on the proposal until June
25th.
I'm leaving a link to this in the show notes so that you guys can see the PDF yourself.
If you have expertise, if you have a personal opinion that is genuinely productive and can
be useful, I encourage you to share that before June 25th so that it can actually be, hopefully,
in some way, shape, or form taken into consideration.
That is all I have to say about this story.
Now we're going to get into the defense bulletin.
Starting with the data breaches.
These are just random breaches from the last week.
DentaQuest was hit with a data breach.
This is a dental insurance company.
So if you use this, you should look into it.
It actually has to do with the Shiny Hunters gang,
which has been making tons of rounds lately.
So check it out if you want to learn more in the show notes.
Up next, we have the UN Food Agency, which has disclosed a breach affecting 600,000 Gaza households.
So this is the World Food Program, WFP.
They disclosed this incident in a Sunday Telegram message, that's a first,
saying that the self-registration application used for assistance registration in Gaza had been breached,
which is a bit sad.
It's already a very tough subject to navigate,
and now having to deal with a data breach on top of that is very difficult.
They leaked a lot of sensitive information.
And so if you in any way are involved with this, you should look into it in the show notes.
There's a company called ServiceNow, which based on a quick search is like an AI agentic thing.
But they've disclosed a security incident exposing customer data.
And so if you or a company or someone you know uses this kind of tool, you need to point them this direction.
And again, links to everything are in the show notes.
I'm not going to say it again because I keep saying it on every story.
Next one is Sofi, Sofi, S-O-F-I.
has confirmed a third-party data breach at their Hong Kong subsidiary.
So if you know anyone who is involved with this, definitely check it out.
I didn't know where to put this this week.
I was almost going to make it a main story, but there wasn't enough juice.
Wasn't enough squeeze in the juice.
You guys know what I'm trying to say.
But I also didn't know if I should put it in data breaches or threats.
So I'm just putting it here.
But Dashlane, this is a highlight story recently,
had a data breach where 20 password vaults were breached.
And actually, we now finally have a lot more information.
Pretty much, they just tried to brute force through API endpoints for device registration.
And they tried to send a lot of automated requests.
Their automated security system actually triggered an automatic lockout.
But they still, before that was fully mitigated, still led to 20 personal customers from getting their vault stolen from them.
Now, the good news is that Dashlane, unlike LastPass, doesn't have any unencrypted fields.
So everything is encrypted.
And it uses an algorithm called Argon2, which is a much more secure version of password security.
And so I will say, you know, based on Dashlane's initial responses, which were quite weak,
this is looking a lot better for Dashlane and is representing a much better overall security
posture than what LastPass demonstrated in their 2022 data breach.
So I'm a bit happier to see this.
But even then, if you are one of those people, which Dashlane would have contacted you if
you were, if you're one of those 20 people, your vault is completely dependent. Yes, it has Argon,
it has all these cool things, it's all encrypted, but you know, it's still up to whether or not you
had a strong master password. So if you are one of those 20 people and the complete off chance you're
one of those people and you listen to this podcast and just change all of your passwords and assume
that everything in there is compromised. So if you have any cryptocurrency in there, you should
probably move it to a different wallet, all that kind of stuff. That's my recommendation to you.
Otherwise, interesting and probably not as devastating as this could have been for Dashlane.
And I'm happy that they finally included more details.
Oxford University has disclosed a data breach after careers platform hack.
And so this is from their third party provider, but it impacts anybody who used it.
And so definitely check this out if you want to learn more.
This is an update to a story I covered last week, but it's pretty much just coverage that
that really stupid, like genuinely stupid attack where Meta had an AI chatbot in Instagram,
which allowed anybody to just ask the AI chatbot to get access to someone else's account.
And it said, sure.
Now, they've revealed now that over 20,000 Instagram users had their accounts hijacked
using this exact system.
It is unbelievable.
And again, going back to, because also the highlight story was meta,
this is just such a reckless company.
So if you are putting anything that requires trust to this company,
I would think twice about that.
They do not care about your safety, period.
It doesn't matter what product they're working on.
They will find a way to screw it up, I swear.
And now I'm going to move on because I can't deal with this anymore.
The French government is the last data breach because they had a messaging service that was
breached in an account hijacking attack.
Now we're going to get into the threats, which is the next subsection.
This is just things that I should put on your radar because it could impact your safety.
So the first one is that Google has patched a new Chrome zero-day flaw exploited in the
wild.
And so if you use Chrome or any other Chromium-based browser, make sure you're staying up to date
to get those zero-day patches.
All right, we got more WordPress stuff as we do every week now, but there's an Everest Forms Pro, which I'm assuming is a plugin. Yep, Everest Forms Pro plugin had a vulnerability that was exploited to take over WordPress. And so if you use that, check it out and try to patch that up.
Now, WhatsApp says that it caught new spyware attacks linked to NSO Group in violation of a court order.
Now, this is nothing too new, but if you use WhatsApp, they should hopefully be notifying you.
And it's important to mention that WhatsApp now has a new security feature to try to essentially do like Apple's lockdown mode, but within the WhatsApp ecosystem.
It's called strict account settings.
But if you are somebody who is a journalist or you have a higher threat model and you're forced to use WhatsApp for whatever reason, this is something to consider.
if you are concerned about these government attacks against you.
This is the continuing saga with Mr. Nightmare Eclipse,
which we've been doing coverage for nearly every week now
for the last four plus weeks.
But this is a disgruntled security researcher slash person
who pretty much just has, you know,
they found all these Microsoft zero days.
But this is just an update that Microsoft has released fixes
for two high severity zero days
that were disclosed by Nightmare Eclipse.
So if you want to keep yourself safe from those zero days,
you should get yourself updated. There was a UnifyOS bug that lets hackers gain root without
authentication. So if you're using Unify, Ubiquity, etc., check that out to learn more.
We also had GOGS that has patched a critical zero-day enabling remote code execution. I
believe we covered this last week, if I'm not mistaken, but get that updated if you use GOGS.
There's also another new supply chain attack called Ironworm, which is a piece of malware that
now have infected 36 packages on the NPM index with InfoStealers. If you are using any of these,
you need to keep up with this because it's quite devastating and we're seeing new stuff every week.
Now, similarly, hackers have compromised 19 packages on PyPy. So things like Dynamo, Spadio,
Coolbox, Ufish, Napari Ufish. I don't know what these things are. I don't use these, but
these are just some of the infected packages. Another supply chain attack. It's crazy because
The supply chain attacks normally are a bit more rare, but we've been seeing them just nonstop.
But this supply chain attack hit Ola browser, H-O-L-A, and pretty much the Windows version was completely compromised to deliver a crypto miner.
So if you use this service, dig into the story because it's quite a serious thing that you should look into.
Now, I recently just talked about how WhatsApp has that strict account settings.
We have lockdown mode.
Google has their advanced protection program, and I think it's Android advanced protection on Android.
Now we have another one to join these more advanced security settings,
which is OpenAI unveiling lockdown mode.
And they're using the same name because they're unoriginal
and they probably asked ChatGPT for what to call it.
But this is to help prevent prompt injection attacks.
It'll also disable live web browsing so you can only access cached content.
The retrieval and display of images from the web,
deep research and agent mode as well be in some way restricted.
It says it's not intended for everyone.
It is designed for people and organizations that handle sensitive data and want stricter protection from data exfiltration risks related to prompt injection.
So I guess if you are and you have to use ChatGPT for whatever reason, this is another tool to throw your way.
This one is bizarre.
I mean, I would not, this was not on my 2026 bingo card to say the least.
But so WWDC had a lot of stuff.
But one of the things that was really interesting is they have these new AI features they're rolling out into the Apple ecosystem, which are going to be polarizing at best.
And one of them is an AI agentic feature.
So if you use Apple passwords,
it'll actually see that you have a weak password
and automatically change it to become a secure password.
I would love to see how this works, if it works.
It's an interesting concept
and it would actually probably overall
keep maybe people a bit safer,
but there's a lot of ifs.
I'm a little skeptical,
but I put it in here because it's interesting.
And then the final threat of the week is 404 quickly covered this company called Signal Trace that is going to add phone, AirPod, and smartwatch trackers to their license plate readers.
Very creepy stuff.
It's using things like Bluetooth and other data to try to link even more information to people who are just living and existing in public.
So if you want to learn more, check out 404 to learn more about that.
Now, we have a lot of fun open source news this week.
So we're going to get into the FOSS Plus updates.
FOSS, FOSS adjacent, source available.
open standard, whatever you want to call it.
It's supposed to be a fun little way to finish the podcast.
So Tails released version 7.8.1.
This is the anonymous ephemeral operating system,
and it mostly includes a fix to a security vulnerability.
Otherwise, I don't see any kind of like major feature updates,
but make sure to get updated if you're using Tails.
This is a bit more of a technical one,
but Firefox has merged support for Vulkan video decoding.
This is exciting because it means if you use things like NVIDIA or something on Linux,
you're probably going to get better video playback
and have better compatibility with Linux drivers,
graphics drivers specifically.
I know there's probably a weirdly high amount of people
listening to this podcast that this might actually impact,
even though the regular world would see this
as a crazy niche technical thing.
I think for a lot of you listening,
this might actually impact you.
This is a quick update to Firefox VPN.
They released it with 50 gigabytes of pretty much bandwidth
and it's completely free.
I actually interviewed literally the head of Firefox
on Techlore Talks, our sister podcast.
So if you want to learn more about the threat model, how this is different from Mozilla VPN,
I asked all those questions so I can learn more about it.
But they just announced that they are going to be making it unlimited for a limited time.
From now through August 31st, they are just straight up going to make it unlimited.
So I guess if you haven't played around with it yet, try it out.
It's actually pretty sound.
And I think it's good for especially beginners who don't use anything.
It's a good way to dip their toes into something that's free and actually isn't bad from a privacy perspective.
All right, Nextcloud Hub 26 is here.
This is a really exciting time to be a Nextclouder
because this is their 10-year anniversary, I believe.
So it's their anniversary release,
plus they have EuroOffice stuff,
plus they have just the typical exciting updates.
It's got design updates.
And now you can choose between having Nextcloud Office
being powered by Collabora or EuroOffice.
I'm looking at these screenshots of EuroOffice right now,
and if you're watching the video, you can see them.
And I gotta say, it looks pretty fire.
So I think that's pretty cool.
There are, as always, a bajillion things that are new.
So if you are using NextCloud, check it out.
On a similar note, if you don't like NextCloud for whatever reason,
or you prefer something that's just hosted and out there for you,
Proton has ProtonDrive updates.
So it's now supposedly three times faster on all platforms
with two times faster downloads.
Now, they also have ProtonDrive CLI coming to your terminal,
which is also available on Linux,
which I think is actually a really good step forward.
People have been begging for the ProtonDrive Linux client for years now, as have I, and
I've seen all the comments.
And they even say we are developing their fully featured Linux app as well.
The CLI already allows you to script a lot of ProtonDrive's key features from your favorite
scripting environments.
So I think that they even say it's not a full replacement, but I think the fact that we
have a ProtonDrive CLI for Linux is huge, all right?
That's already like almost there.
And I think that the GUI and everything should come shortly after, I'm hoping.
I don't have any insider information on this,
so I'm kind of just giving you my observations
based on the blog articles.
All right, Fudo Keyboard is introducing
more accurate swipe typing,
Unicode 17 emoji support, and more.
A lot of you have told me directly
that you love the Fudo Keyboard,
and that's what you use.
And so make sure to get yourself updated
if you want those benefits.
Brave has officially released Origin
for a paid bloat-free browsing experience.
I did a whole review of Brave Origin.
If you want to check that out,
it's going to be as a card
as well as in the show notes.
So I've already done a ton of coverage for this
and what the $60 browser looks like,
whether or not you should use it.
The next article is from
the Free Software Foundation of Europe
and they've come forward
and they've said that EU tech sovereignty
is a big milestone for public code.
So they have this overall concept
that is called public money, public code.
It means if you are a taxpayer
and you're contributing to a public service
like a government,
it should also have public code
that you can verify and inspect
and make sure it's actually working for you.
I think it's a very simple concept
that a lot of open source advocates will get behind,
but I think everybody should get behind this.
This is an update that just commends
the European Commission's explicit recognition
of this public money, public code campaign.
Now they do still say that the commission
still falls short on concrete goals,
milestones, and secure funding for free software,
but the procurement reform will be a test.
Public money, public code must become
a mandatory requirement for public tendering.
And Lucas from the Free Software Foundation of Europe,
who I've also interviewed on our podcast, Tackler Talks,
so definitely check that out if you want to learn more.
He was a brilliant guest.
but he also talked about what matters now is implementation these commitments need secured
long-term funding meaningful involvement of independent experts and civil society
and effective enforcement of the dma to ensure free software can can thrive in a fair market
so if you want to learn more this is a great article and a great recap of what's going on
in europe's open source scene right now and now we have the last open source story of the week so
this is a brand new app that came from a security researchers named misc is who they're known as
They released an app called Loop, L-O-U-P-E.
It's completely open source.
And what it does is for iPhone, iPad, Apple users,
essentially mobile Apple users,
it literally just tells you what apps really know about you.
It's very demonstrative.
And you just download the app.
It keeps all the data inside of the app.
And it just says, hey,
I noticed that you probably have Signal installed on your phone.
You have Proton installed on your phone.
Oh, you have these recent locations.
It pretty much goes through everything
that a random app can install on your phone,
all without even having a single app permission granted.
So it breaks things up between
what is just passive data collection
versus what you can grant access to to certain apps.
But this is such a powerful educational tool.
And so I recommend you guys download this yourself.
It's completely free.
It's open source.
I played around with it.
It was very interesting.
And I even recorded a quick video
to actually break it down a little more formally.
So that video should be going live in the next week or so
if you guys want to see it.
But I think this is a perfect recommendation
to share with friends and family.
and people who don't really understand
just how invasive downloading a native app can be.
All right, everybody, it was a long week this week.
There were, I think, over 50 stories.
So thank you all for sticking with me.
And that's going to conclude
this week's Techlore Surveillance Report.
If this analysis helped you reclaim control,
you can become a Techlorian
by visiting a link in the show notes.
We couldn't do it without your guys' support.
You also gain access to the private communities
like Signal that we have access to.
And you also get key perks
like my private RSS feed
that I'm updating throughout the week
with all of these stories.
so you don't have to wait till Wednesday to get the full episode.
You can just track my RSS feed,
and then you don't have to track all the other ones yourself.
If you don't want to financially support things, totally cool.
You can also leave a rating.
You can share the episode to still spread all this information with people you know.
Either way, I want to thank you all for listening,
and I'll see you in the next episode of Surveillance Support in two weeks.
And don't forget to check out our sponsor this episode, Davaik,
and I want to thank them as well for making this possible.
See you all next time on Techlore.