1
00:00:01,579 --> 00:00:07,740
This week's surveillance report covers Meta's hidden facial recognition code on millions of devices.

2
00:00:08,320 --> 00:00:10,860
Microsoft repos have been weaponized against AI users.

3
00:00:11,360 --> 00:00:15,660
The UK's push to scan every single device with Signal having to respond.

4
00:00:16,240 --> 00:00:19,440
A good and bad news week for state privacy laws in the US.

5
00:00:19,820 --> 00:00:23,320
And the usual data breaches, threats, and open source updates.

6
00:00:23,820 --> 00:00:26,020
Welcome everybody to the Techlore surveillance report.

7
00:00:26,220 --> 00:00:31,800
your essential weekly tech news, delivering deep analysis on the latest threats to your security,

8
00:00:32,279 --> 00:00:37,520
privacy, and digital freedom. And of course, empowering you to reclaim, control, and defend

9
00:00:37,740 --> 00:00:43,160
your right. I'm Henry, and we got a big week this week, so let's not waste any time. Just a very

10
00:00:43,320 --> 00:00:46,820
quick announcement before we get into the meta story is that we're going to be traveling and

11
00:00:46,960 --> 00:00:50,700
decided not to try to force this. We're not going to have a surveillance report next week,

12
00:00:50,960 --> 00:00:54,260
and there's also going to be no live stream next week. We're going to have clips that we're going

13
00:00:54,220 --> 00:00:57,820
to be rolling out. We have other content that we'll still be publishing, but we are skipping a

14
00:00:57,920 --> 00:01:01,920
week of this podcast and then we're going to be returning in two weeks. Without further ado,

15
00:01:02,140 --> 00:01:07,220
let's cover the company that I always got to make sure I maintain my composure when I talk about

16
00:01:07,260 --> 00:01:12,460
them because it can be quite infuriating, but this has to do with Meta. This is supposedly inside of

17
00:01:12,580 --> 00:01:18,800
the Meta AI app. It's a dedicated app for Meta AI and they embedded this unreleased face recognition

18
00:01:19,080 --> 00:01:23,299
system into the app onto more than 50 million phones. Now, if you're curious what this is

19
00:01:23,320 --> 00:01:28,240
supposed to do. It is as scary as it could possibly sound. Essentially, this feature was

20
00:01:28,420 --> 00:01:33,120
designed, and this is quoting Ars, to convert faces captured by their glasses into unique

21
00:01:33,500 --> 00:01:37,980
biometric signatures, commonly known as face prints, and then compare them against the database of

22
00:01:38,310 --> 00:01:43,040
face prints stored on the user's device. Wired also found that faces the system failed to recognize

23
00:01:43,110 --> 00:01:47,860
were cropped, indexed, and stored locally for future processing. And that name name tag was actually

24
00:01:48,160 --> 00:01:52,820
still referenced in several code libraries the day that Wired came forward with the story,

25
00:01:52,960 --> 00:01:54,600
and made it public to the world.

26
00:01:54,970 --> 00:01:56,680
But then Friday's release includes none of them.

27
00:01:56,710 --> 00:01:59,620
So now they're trying to essentially cover up the fact that this happened.

28
00:01:59,850 --> 00:02:03,280
I think the best part with any meta story is the kind of response,

29
00:02:04,000 --> 00:02:04,920
sometimes lack thereof.

30
00:02:05,200 --> 00:02:06,500
Meta pretty much came forward and said,

31
00:02:06,620 --> 00:02:09,259
this feature is purely exploratory,

32
00:02:09,479 --> 00:02:12,540
adding no final decision has been made on what to do here, if anything.

33
00:02:12,810 --> 00:02:17,300
I find that funny because the feature was referenced in public versions of an app

34
00:02:17,370 --> 00:02:19,720
that anybody could download and was on 50 million devices.

35
00:02:20,040 --> 00:02:24,140
So at least to me, if I was a software development company, I knew what the hell I was doing.

36
00:02:24,560 --> 00:02:37,440
If it was actually exploratory, I wouldn't be embedding it on their devices yet because I wouldn't be putting experimental software that I still don't know if I want my users to be using on their devices because I think that's a complete invasion of trust, privacy, security, just common sense.

37
00:02:37,900 --> 00:02:40,820
Or they're just straight up lying and they are trying to roll this out.

38
00:02:41,300 --> 00:02:42,840
I guess time will tell which one it is.

39
00:02:42,980 --> 00:02:46,840
Either of them just perfectly align with how Meta functions as a company.

40
00:02:47,120 --> 00:02:56,940
The best part to the same person from Meta came forward and said that they can't answer questions about how the system would work because, quote, the feature doesn't exist.

41
00:02:57,460 --> 00:03:01,980
Meta's CTO even said the reporting was incredibly misleading and absolutely dishonest.

42
00:03:02,860 --> 00:03:14,860
Meta declined to answer 10 questions that Wired posed before publishing on Thursday, including whether it had already created a database of face profiles, how long the app retains photographs and biometric data, and whether that data would ever be sent back to Meta's servers.

43
00:03:15,100 --> 00:03:18,160
So they never actually responded to those questions before Wired came forward.

44
00:03:18,360 --> 00:03:23,440
So I don't know how much Meta can say it was misleading or dishonest, you know, reporting

45
00:03:23,720 --> 00:03:27,700
when Wired, first off, seems like they covered everything truthfully and was factual about

46
00:03:27,880 --> 00:03:27,960
it.

47
00:03:28,500 --> 00:03:31,740
And they literally asked Meta for their opinion and they didn't respond.

48
00:03:32,120 --> 00:03:33,500
And now they're mad about the coverage.

49
00:03:33,760 --> 00:03:35,180
It's like, dude, cry me a river.

50
00:03:35,720 --> 00:03:40,580
Now, I actually made a video about this not that long ago where I talked about the creepiness

51
00:03:40,660 --> 00:03:41,260
of these glasses.

52
00:03:41,440 --> 00:03:44,660
Somebody actually bought a pair of these Meta Ray-Ban AI glasses.

53
00:03:45,140 --> 00:03:48,540
and they started, pretty much the headline was quite interesting because they said,

54
00:03:48,540 --> 00:03:50,180
I started to feel like a creep myself.

55
00:03:50,520 --> 00:03:54,320
And apparently a common term that's thrown around on the internet for them is the pervert glasses

56
00:03:54,600 --> 00:03:56,100
and how easy it is to spy on people.

57
00:03:56,200 --> 00:03:57,340
They don't think twice about it.

58
00:03:57,360 --> 00:03:58,080
It blends in.

59
00:03:58,460 --> 00:04:02,960
And so, and even then they were kind of talking about Metta's intentions of rolling this out

60
00:04:03,380 --> 00:04:05,020
to have actual facial recognition.

61
00:04:05,220 --> 00:04:07,720
It's something that they've announced as something they might want to do in the future.

62
00:04:08,360 --> 00:04:10,520
And of course, this is a complete privacy nightmare.

63
00:04:10,680 --> 00:04:12,640
Imagine someone that you don't even know is wearing glasses,

64
00:04:13,100 --> 00:04:17,060
is walking around the street and essentially just trying to profile people around them.

65
00:04:17,070 --> 00:04:21,120
And actually, people have already started to start running third-party code on these glasses

66
00:04:21,250 --> 00:04:22,760
to make that functionality happen.

67
00:04:22,930 --> 00:04:24,900
So whether or not Meta chooses to do it,

68
00:04:25,260 --> 00:04:27,420
they've already put out the hardware to make this possible for people.

69
00:04:27,740 --> 00:04:30,180
They don't seem to care about controlling that in any way.

70
00:04:30,560 --> 00:04:32,460
In fact, they want a part of that action.

71
00:04:32,570 --> 00:04:34,640
That is eventually what they probably want to do.

72
00:04:34,980 --> 00:04:37,340
And this is their first step in doing so.

73
00:04:37,390 --> 00:04:37,920
But don't worry.

74
00:04:38,100 --> 00:04:39,680
It's completely misleading reporting.

75
00:04:39,900 --> 00:04:40,980
It's completely dishonest.

76
00:04:41,140 --> 00:04:42,060
We're overreacting.

77
00:04:42,680 --> 00:04:44,460
whatever else the meta people are going to think.

78
00:04:44,780 --> 00:04:47,580
I think this company, again, I go back to this.

79
00:04:47,740 --> 00:04:49,320
It is just such a rotten company.

80
00:04:49,430 --> 00:04:51,900
I mean, they have absolutely zero ethics.

81
00:04:52,050 --> 00:04:53,020
It is all about money.

82
00:04:53,100 --> 00:04:54,980
It's all about chasing what the next big thing is.

83
00:04:55,230 --> 00:04:57,360
And so I just, I beg all of you,

84
00:04:57,520 --> 00:04:59,480
if you know someone who's thinking about buying these glasses,

85
00:05:00,020 --> 00:05:02,460
kindly educate them about the privacy implications,

86
00:05:02,960 --> 00:05:05,320
educate them about how this is a lot of trust

87
00:05:05,370 --> 00:05:06,740
they have to hand a company like Meta.

88
00:05:07,600 --> 00:05:10,920
And they're going to do things the sloppiest possible way

89
00:05:11,080 --> 00:05:12,080
just so they can get there first,

90
00:05:12,340 --> 00:05:16,560
because that's the only potential advantage they're ever going to have by doing these things.

91
00:05:16,900 --> 00:05:20,460
Don't hop on this. There are going to be better options someday if this actually is something

92
00:05:20,860 --> 00:05:24,980
worth paying attention to. I actually really liked some of the comments on Ars Technica. I'll read a

93
00:05:24,980 --> 00:05:28,480
few out. This company can't be trusted full stop. They need to be erased from the history books,

94
00:05:28,680 --> 00:05:33,340
and steps need to be taken to ensure it cannot happen again. Death to all things meta. The whole

95
00:05:33,380 --> 00:05:37,379
smart glasses product from them is creepy and deserves no buyers. I can't understand people

96
00:05:37,400 --> 00:05:38,840
who purchase things from this company.

97
00:05:39,300 --> 00:05:42,020
So yeah, lying liars tell lies.

98
00:05:42,120 --> 00:05:43,660
I think that's a good way to finish that one.

99
00:05:49,580 --> 00:05:51,660
Coming up, we have the UK ultimatum

100
00:05:51,680 --> 00:05:53,560
to scan all content on devices.

101
00:05:53,780 --> 00:05:55,740
And Signal actually did a formal response to that.

102
00:05:56,000 --> 00:05:56,960
We have some good and bad news

103
00:05:57,220 --> 00:05:58,480
between two different states in the US.

104
00:05:58,900 --> 00:05:59,760
And we also have the SEC

105
00:05:59,900 --> 00:06:01,140
that wants to kill burner phones.

106
00:06:01,360 --> 00:06:02,500
It is a crazy week.

107
00:06:03,100 --> 00:06:05,140
But before then, we have Microsoft,

108
00:06:05,540 --> 00:06:07,280
who's had a very interesting week.

109
00:06:07,640 --> 00:06:10,160
So we're going to start here that for the second time in weeks,

110
00:06:10,340 --> 00:06:13,260
Microsoft has packages that are laced with credential stealers.

111
00:06:13,440 --> 00:06:17,620
So these were 73 packages that ran self-replicating stealers

112
00:06:17,670 --> 00:06:19,740
as soon as they're opened by an AI agent.

113
00:06:19,790 --> 00:06:21,600
So that original attack that happened in mid-May,

114
00:06:21,870 --> 00:06:24,680
which had to do with some Python SDK and PyPy,

115
00:06:24,800 --> 00:06:28,360
but that actually involved an account takeover of a Microsoft GitHub account.

116
00:06:28,760 --> 00:06:29,960
So that account was compromised,

117
00:06:30,430 --> 00:06:32,360
and that's how they were able to essentially push that update.

118
00:06:32,760 --> 00:06:38,020
It was that same exact account that was used for this new compromise.

119
00:06:38,260 --> 00:06:42,300
You know, ours covers and says the explanation for this double compromise isn't currently known.

120
00:06:42,440 --> 00:06:45,540
It may mean that Microsoft failed to fully change credentials for the account.

121
00:06:45,820 --> 00:06:50,900
It may also be the result of an unknown package run on a Microsoft developer machine that stole the new credentials.

122
00:06:51,380 --> 00:06:53,660
Microsoft isn't providing details at the moment.

123
00:06:53,920 --> 00:06:58,280
Now, these packages executed payloads that are designed to pretty much recap it.

124
00:06:58,480 --> 00:07:01,440
They are supposed to steal things from password managers.

125
00:07:01,960 --> 00:07:03,300
They steal keys from developers.

126
00:07:04,080 --> 00:07:04,680
It's not good.

127
00:07:04,770 --> 00:07:08,840
And it even spreads laterally through cloud infrastructure to infect other developer machines.

128
00:07:09,500 --> 00:07:14,260
And so if you are in any way using any kind of these tools, this is something you need

129
00:07:14,260 --> 00:07:14,780
to look into.

130
00:07:14,980 --> 00:07:15,720
It's pretty serious.

131
00:07:15,910 --> 00:07:19,220
And it's actually called the miasma worm, if you want to know the actual name of the

132
00:07:19,460 --> 00:07:19,540
malware.

133
00:07:20,140 --> 00:07:25,440
And if you are using any of these tools at all, you should 100% look into the show notes.

134
00:07:25,700 --> 00:07:30,080
This happened on June 5th, and it was contained within 105 seconds.

135
00:07:30,440 --> 00:07:35,960
And so it's unlikely this impacts any of you, but this is 100% worth digging into because,

136
00:07:36,240 --> 00:07:38,860
you know, you might have just got the wrong update or the wrong piece of software at the

137
00:07:38,860 --> 00:07:39,360
wrong time.

138
00:07:39,740 --> 00:07:44,280
And that might just be missing something here because there was a security engineer who

139
00:07:44,400 --> 00:07:48,680
came forward and said that this June 5th incident appeared to be part of a malware campaign

140
00:07:48,840 --> 00:07:51,620
that infected 32 of Red Hat's NPM packages.

141
00:07:51,920 --> 00:07:56,160
And so essentially they pivoted from those NPM packages to Microsoft resources on GitHub.

142
00:07:56,440 --> 00:08:08,680
To me, when I read that, it contradicts a little bit the story and what they're saying in Arse, which is that it was the same compromise attack, which seems to point to some compromise on a developer's machine.

143
00:08:09,220 --> 00:08:10,920
These things aren't inherently contradictory.

144
00:08:11,030 --> 00:08:14,580
It's just the way they're presented to me don't seem like the same story.

145
00:08:14,710 --> 00:08:20,360
And so I actually do hope we get a few more answers on what's going on here because I'm confused reading this coverage.

146
00:08:20,700 --> 00:08:37,860
The real takeaway from these stories is that if you are using any kind of new technology, if you're using AI, if you're downloading things, you're ahead of the time, you are open to more of these risks. And this is a huge, huge area right now with a lot of attack surface and people are really targeting those kinds of developers. So just be on the lookout. This is going to keep happening.

147
00:08:43,880 --> 00:08:47,860
All right, coming soon, we have some states in the U.S. which has some good news and some bad news.

148
00:08:47,920 --> 00:08:51,240
And we have the FCC federally who wants to kill burner phones.

149
00:08:52,020 --> 00:08:59,980
But before we get there, we have the U.K.'s ultimatum to scan all content on all U.K. devices.

150
00:09:00,480 --> 00:09:11,320
So the U.K. has been going on this absolute rampage in the last year of just throwing surveillance at every possible digital problem and thinking it's going to solve the issues.

151
00:09:11,420 --> 00:09:14,500
They think, oh, you know, kids are suffering with issues online.

152
00:09:14,840 --> 00:09:16,300
Let's just surveil everything.

153
00:09:16,540 --> 00:09:19,280
Oh, big tech companies are influencing everything in a negative way.

154
00:09:19,340 --> 00:09:20,780
Let's just throw surveillance at it.

155
00:09:20,900 --> 00:09:22,360
Our economy is not doing very good.

156
00:09:22,680 --> 00:09:23,980
Let's throw surveillance at it.

157
00:09:24,140 --> 00:09:30,400
So it's quite concerning when I see, you know, such a movement towards all of this surveillance

158
00:09:30,760 --> 00:09:33,780
technology when there's very little evidence to actually back it up.

159
00:09:33,940 --> 00:09:37,700
And I think that especially this child stuff is quite concerning, the age verification,

160
00:09:38,180 --> 00:09:40,600
the propositions to ban things like VPNs.

161
00:09:40,660 --> 00:09:42,100
It is absolutely crazy.

162
00:09:42,760 --> 00:09:46,580
Now, the prime minister said tech companies must activate nudity detection algorithms or

163
00:09:46,820 --> 00:09:50,940
other technical solutions on smartphones and tablets to prevent users taking photos or

164
00:09:51,120 --> 00:09:54,320
sharing images of genitalia unless they are verified as adults.

165
00:09:54,780 --> 00:09:59,580
Now, I don't think anyone is going to reject this overall premise, but like everything else

166
00:09:59,720 --> 00:10:04,000
I've talked about, they are refusing to acknowledge the actual technical limitations of what makes

167
00:10:04,060 --> 00:10:05,080
that very hard to do.

168
00:10:05,360 --> 00:10:09,280
In order to actually prevent that from happening, you have to verify everybody's identity and

169
00:10:09,400 --> 00:10:10,360
tie that to their device.

170
00:10:10,920 --> 00:10:12,860
which is obviously a privacy concern.

171
00:10:13,090 --> 00:10:14,540
And no one has actually put forward

172
00:10:14,920 --> 00:10:16,860
a really solid way of fixing this problem.

173
00:10:17,220 --> 00:10:18,800
The worst part is, again, it's an ultimatum.

174
00:10:18,850 --> 00:10:21,060
So they say if businesses do not comply within three months,

175
00:10:21,200 --> 00:10:22,460
legislation will be brought forward

176
00:10:22,760 --> 00:10:25,780
requiring the protection to be added to all phones in the UK.

177
00:10:26,120 --> 00:10:29,760
I think encryption is actually part of the protection for these kids.

178
00:10:29,810 --> 00:10:33,580
I think giving kids safe spaces where they aren't being surveilled,

179
00:10:33,900 --> 00:10:35,580
where it's hard for people to access them,

180
00:10:35,780 --> 00:10:38,299
where they're only there with their trusted friends and family

181
00:10:38,320 --> 00:10:40,940
is a necessary thing to keep kids safe as well.

182
00:10:41,340 --> 00:10:44,200
Now, in light of this, Signal did come forward

183
00:10:44,540 --> 00:10:46,280
and, you know, Signal, the encrypted messenger.

184
00:10:46,780 --> 00:10:47,180
We like them.

185
00:10:48,100 --> 00:10:49,420
But they put out a statement

186
00:10:49,700 --> 00:10:51,100
on the UK's latest threat to privacy.

187
00:10:51,780 --> 00:10:52,960
And you guys should all read it.

188
00:10:53,020 --> 00:10:53,500
It's very quick.

189
00:10:53,680 --> 00:10:54,980
It's literally a single page.

190
00:10:55,060 --> 00:10:56,560
It's pretty much them just coming forward

191
00:10:56,630 --> 00:10:57,600
and saying that this proposal

192
00:10:57,630 --> 00:10:58,720
will not keep children safe.

193
00:10:59,160 --> 00:11:01,200
Child safety looks like well-funded education,

194
00:11:01,660 --> 00:11:02,840
robust social services,

195
00:11:03,200 --> 00:11:04,380
and meaningful guardrails

196
00:11:04,380 --> 00:11:06,560
on the very AI technologies and platforms.

197
00:11:07,100 --> 00:11:09,100
the current government is eagerly courting.

198
00:11:09,130 --> 00:11:11,240
And I think that is the most ironic part about this.

199
00:11:11,740 --> 00:11:13,040
What the UK government wants instead

200
00:11:13,400 --> 00:11:15,020
is invisible surveillance infrastructure

201
00:11:15,500 --> 00:11:16,380
switched on by default

202
00:11:16,560 --> 00:11:19,240
and potentially rushed into law under cynical pretexts.

203
00:11:19,600 --> 00:11:20,760
All of this with scant care

204
00:11:20,790 --> 00:11:22,080
for the actual needs of the children

205
00:11:22,190 --> 00:11:23,240
they claim to be protecting

206
00:11:23,700 --> 00:11:25,680
or the horrifying and far-ranging consequences

207
00:11:25,960 --> 00:11:27,300
that will ensue in practice.

208
00:11:27,840 --> 00:11:30,960
So again, I think they somehow compiled everything

209
00:11:31,140 --> 00:11:32,640
into one paragraph very nicely.

210
00:11:33,120 --> 00:11:34,760
So good on Signal for coming forward.

211
00:11:34,930 --> 00:11:37,060
And I'll be keeping up to date with this story

212
00:11:37,080 --> 00:11:39,860
So stay subscribed and you guys will see it in future episodes.

213
00:11:40,070 --> 00:11:41,240
Not next week, but the week after.

214
00:11:41,580 --> 00:11:44,600
All right, coming soon, we have good and bad news in the US from two different states.

215
00:11:44,690 --> 00:11:48,320
And we have the FCC wanting to kill burner phones, but we actually have a new sponsor

216
00:11:48,580 --> 00:11:49,660
called Davaic.

217
00:11:49,730 --> 00:11:50,820
I think that's how you say it.

218
00:11:50,960 --> 00:11:57,280
When somebody says location history app, every instinct in my body says to run away from

219
00:11:57,280 --> 00:11:58,580
it as fast as I can.

220
00:11:58,960 --> 00:11:59,560
But here's the thing.

221
00:11:59,720 --> 00:12:03,080
Before I got into privacy, I actually really used to like Google Timeline.

222
00:12:03,440 --> 00:12:06,520
And there were some really fun benefits before I understood the privacy implication.

223
00:12:06,920 --> 00:12:10,920
For most people, the only way to get that functionality is to be using a big tech service.

224
00:12:11,370 --> 00:12:14,580
But Davaic is the version where you actually get to keep it.

225
00:12:14,920 --> 00:12:18,660
It's an open source, optionally self-hosted location history app.

226
00:12:18,690 --> 00:12:20,200
So it puts everything in your court.

227
00:12:20,580 --> 00:12:24,760
Basically, Google Timeline, except the map belongs to you as well as all the data.

228
00:12:25,010 --> 00:12:28,360
You can import your existing Google data or data from other platforms as well.

229
00:12:28,680 --> 00:12:29,840
And then you just get to enjoy it.

230
00:12:29,840 --> 00:12:33,240
You can scroll back through a single day, replay the exact route you took,

231
00:12:33,380 --> 00:12:35,600
and light up every country and city that you've visited.

232
00:12:35,900 --> 00:12:38,480
It's also great for traveling to remember important landmarks.

233
00:12:38,610 --> 00:12:43,140
And of course, as an athlete, I actually save my own runs that are my favorite runs and also

234
00:12:43,190 --> 00:12:43,640
my races.

235
00:12:44,030 --> 00:12:46,220
And so I can track where I run all around the world.

236
00:12:46,350 --> 00:12:48,580
And so that's another great use case for this technology.

237
00:12:48,900 --> 00:12:52,640
Pretty much if you like to touch grass and you're an adventurer, but you also don't want

238
00:12:52,640 --> 00:12:56,680
the typical drawbacks that come along with using a service like Google Timeline, you can

239
00:12:56,770 --> 00:13:01,280
self-host Davaik for free, or you can grab the hosted version down in the podcast or

240
00:13:01,300 --> 00:13:09,280
the YouTube video show notes at D-A-W-A-R-I-C-H dot app slash techlor. The code techlor gets you

241
00:13:09,460 --> 00:13:13,940
20% off your first year, and it's an amazing service that you should go try out. And I definitely

242
00:13:14,100 --> 00:13:18,040
recommend to people in their life who are still using Google Timeline, get them off of that stuff.

243
00:13:18,350 --> 00:13:20,540
And now let's get back into the show.

244
00:13:26,620 --> 00:13:31,260
So we have the FCC coming soon that wants to kill burner phones, but before then we have good and

245
00:13:31,280 --> 00:13:32,700
And we're going to start with the good news.

246
00:13:32,700 --> 00:13:40,740
The good news is that Massachusetts has voted to pass new privacy rights bill that bans the sale of precise location data.

247
00:13:41,200 --> 00:13:42,820
This is absolutely awesome.

248
00:13:43,020 --> 00:13:49,140
It was actually unanimous with 146 people voting in favor and zero voting against it.

249
00:13:49,320 --> 00:13:53,000
This blocks the sharing or sale of sensitive information without explicit consent.

250
00:13:53,540 --> 00:13:59,820
It also includes biometrics, precise geolocation data, and other markers about religion, immigration status, and sexual orientation.

251
00:14:00,380 --> 00:14:06,160
I get a lot of people asking and a lot of comments from people saying that regulation isn't going to fix the privacy concerns.

252
00:14:06,250 --> 00:14:07,960
And I overall pretty much agree with that.

253
00:14:07,970 --> 00:14:13,040
But the problem is if we don't have some laws that give people rights, they have nothing to actually fall back on.

254
00:14:13,040 --> 00:14:14,700
They don't have rights.

255
00:14:15,150 --> 00:14:16,240
So it's a bit of a problem.

256
00:14:16,510 --> 00:14:23,140
I think they're a major step forward in just bumping up the baseline so that companies can't just do things without consequences.

257
00:14:23,160 --> 00:14:30,360
It means that when something happens to you, you actually have rights that you can lean on to actually hold somebody else accountable.

258
00:14:31,000 --> 00:14:34,120
So I don't think this is going to solve the data broker industry overnight.

259
00:14:34,400 --> 00:14:38,040
I'm not delusional, and I don't think many people who are pushing for this think that either.

260
00:14:38,540 --> 00:14:41,620
I think what's going to happen, though, is that companies need to think twice.

261
00:14:41,830 --> 00:14:46,860
They need to go through some kind of hurdles in order to take data they would have been able to take easier beforehand.

262
00:14:46,920 --> 00:14:48,880
and when something actually does go wrong,

263
00:14:49,200 --> 00:14:51,440
you have a few more avenues that you can pursue

264
00:14:51,880 --> 00:14:53,260
to make sure it gets done properly.

265
00:14:54,199 --> 00:14:56,900
So I'm giving you claps over there in Massachusetts.

266
00:14:57,140 --> 00:14:59,000
You're joining many other states who now have this,

267
00:14:59,060 --> 00:15:00,420
and I would love to see something like this

268
00:15:00,600 --> 00:15:01,400
pushed out federally,

269
00:15:01,800 --> 00:15:04,680
and I hope to see all of these strengthened over time,

270
00:15:05,020 --> 00:15:06,060
not watered down.

271
00:15:06,500 --> 00:15:07,960
That is also a concern I have.

272
00:15:08,180 --> 00:15:08,820
Now the bad news.

273
00:15:09,280 --> 00:15:12,840
So Apple is, well, I guess this deserves

274
00:15:12,840 --> 00:15:13,680
a little bit of context.

275
00:15:13,920 --> 00:15:15,840
So Texas came forward, and Texas was like,

276
00:15:16,240 --> 00:15:21,380
We're the freedom state, so we're going to require everybody to be age verified on their Apple and Google devices.

277
00:15:21,760 --> 00:15:26,560
Now, yes, this means that Apple will need to confirm every user's age when a person creates an Apple account.

278
00:15:27,080 --> 00:15:33,240
And apparently Tim Cook attempted to persuade the Texas governor to veto, but they went ahead and signed it into law.

279
00:15:33,760 --> 00:15:41,260
Anyway, so the real update here is that Apple is formally bringing this to Texas as SB2420 takes effect on June 4th.

280
00:15:41,640 --> 00:15:43,800
So this should have supposedly already happened.

281
00:15:44,300 --> 00:15:46,620
If any of you are based in Texas, let me know what it was like.

282
00:15:46,700 --> 00:15:47,720
It's actually really helpful.

283
00:15:47,760 --> 00:15:52,660
I'm not based in Texas, so I can't see exactly what this looks like on an Apple device.

284
00:15:52,880 --> 00:15:56,940
And so if any of you are based in Texas and you happen to be on YouTube or Spotify and

285
00:15:56,960 --> 00:15:59,040
you can leave a comment, it actually is quite helpful.

286
00:15:59,100 --> 00:16:01,280
And I'd love to hear how that experience has been for you.

287
00:16:01,380 --> 00:16:06,640
The court still need to determine, this is from the article, the constitutionality, that's

288
00:16:06,860 --> 00:16:11,920
a good word, of SB 2420 and whether the state has the authority to impose age verification

289
00:16:12,080 --> 00:16:13,580
requirements on app marketplaces.

290
00:16:13,960 --> 00:16:17,340
Yeah, and the reason for that is because they temporarily stayed the injunction, which still

291
00:16:17,500 --> 00:16:21,380
allows the law to go into effect, but they apparently can still dish this out. I guess,

292
00:16:21,800 --> 00:16:25,560
you know, this is something that we can still advocate for. We can still make our voices heard,

293
00:16:25,840 --> 00:16:29,680
especially if you're in Texas, contact your politicians. This is a big thing to get involved

294
00:16:29,880 --> 00:16:33,300
about. So get involved if you're in Texas. If you're not in Texas, you should still be contacting

295
00:16:33,440 --> 00:16:37,160
your politicians often about what you're passionate about in a digital rights space and let them know

296
00:16:37,220 --> 00:16:40,560
what you like and don't like, especially if it's relevant to something happening to you locally.

297
00:16:41,120 --> 00:16:42,900
Those are the two updates, but now let's go federal.

298
00:16:49,000 --> 00:16:50,260
No one likes robocallers.

299
00:16:50,420 --> 00:16:51,980
Nobody likes child abuse.

300
00:16:52,520 --> 00:16:54,000
Nobody likes all these problems.

301
00:16:55,100 --> 00:16:59,500
But let's also just find the most lazy way to deal with it.

302
00:16:59,730 --> 00:17:02,460
Pretty much the way that they want to stop robocalls

303
00:17:03,100 --> 00:17:06,480
is to just ban burner phones and force U.S. consumers

304
00:17:06,610 --> 00:17:09,459
to hand over more data to telecommunications companies,

305
00:17:09,740 --> 00:17:14,339
which are notoriously some of the least trustworthy companies out there on the market.

306
00:17:14,560 --> 00:17:17,579
These are people who collect your SMS, all your messages you send.

307
00:17:17,750 --> 00:17:19,180
They collect your social security number.

308
00:17:19,500 --> 00:17:21,880
They leak your social security number through data breaches.

309
00:17:22,060 --> 00:17:25,319
They collect information about you, your family, who you contact,

310
00:17:25,860 --> 00:17:27,760
all of your web traffic, your DNS queries.

311
00:17:28,079 --> 00:17:30,620
These are literally some of the least trustworthy people

312
00:17:31,080 --> 00:17:32,980
that are possibly out there in the tech industry.

313
00:17:33,420 --> 00:17:37,240
And now, just like we're doing with children, we're putting more power in their court.

314
00:17:37,340 --> 00:17:44,460
We're asking Apple when it comes to children and Google to now be the gatekeepers of child safety when we ask them to roll out features to keep the children safe.

315
00:17:45,080 --> 00:17:45,640
Same thing here.

316
00:17:45,720 --> 00:17:53,840
We're asking now the telecommunications companies to be in charge of themselves to navigate a problem they haven't been able to solve yet.

317
00:17:54,260 --> 00:17:56,780
By now just making everything worse for everybody.

318
00:17:57,360 --> 00:18:00,800
I find this infuriating and I think people should be angry about this.

319
00:18:00,900 --> 00:18:04,620
Because it's like, why are you putting more power and trust into the people that literally

320
00:18:05,200 --> 00:18:08,060
haven't been able to figure this out and have been part of the problem this whole time?

321
00:18:08,380 --> 00:18:12,920
Now, the good news is that the FCC's proceeding is more about soliciting public and industry

322
00:18:13,260 --> 00:18:14,400
input on the new rules.

323
00:18:14,840 --> 00:18:18,940
They say, quote, would requiring the collection of this information help cut down on illegal

324
00:18:19,180 --> 00:18:19,820
calls, they ask.

325
00:18:20,240 --> 00:18:24,000
What privacy concerns may arise from such a collection of personally identifiable information

326
00:18:24,100 --> 00:18:24,960
and how can we mitigate them?

327
00:18:25,220 --> 00:18:30,040
Now, I will say that's actually a very big step forward to actually have one of these

328
00:18:30,060 --> 00:18:34,500
organizations come forward and actually acknowledge the elephant in the room and say,

329
00:18:34,510 --> 00:18:40,080
how can we help mitigate that is genuinely really good. It doesn't take away from the concerns. And

330
00:18:40,200 --> 00:18:44,880
I'm still not convinced that this is actually gone. But the fact they even came forward and

331
00:18:45,050 --> 00:18:49,460
asked those questions is a million times better than anything the UK has been doing, right? Because

332
00:18:49,520 --> 00:18:53,480
the UK is just like, these aren't concerns. You don't care about child safety. We're just going

333
00:18:53,480 --> 00:18:57,200
to buckle down and we're just going to ignore all the technical problems of everything we're trying

334
00:18:57,220 --> 00:19:01,440
to propose. This is how it's going to work. Otherwise, get out of here or we're going to

335
00:19:01,740 --> 00:19:05,460
regulate you. Literally, I would argue that the data broker industry and the fact that your

336
00:19:05,620 --> 00:19:10,680
information is sold freely in this surveillance economy is probably actually an easier thing.

337
00:19:11,220 --> 00:19:15,320
Well, I don't want to say easier because it involves real work from these politicians, but

338
00:19:15,760 --> 00:19:20,000
that is actually something that would probably prevent a lot of these robocallers. Because I

339
00:19:20,100 --> 00:19:24,020
doubt these robocallers just randomly try different numbers on their phone and hope they reach you.

340
00:19:24,080 --> 00:19:28,340
They have your information because of the data broker industry that is allowed to flourish

341
00:19:28,880 --> 00:19:31,280
because there's absolutely nothing stopping them from doing so.

342
00:19:31,540 --> 00:19:35,980
All of you listening, the FCC is accepting public comments on the proposal until June

343
00:19:36,240 --> 00:19:36,760
25th.

344
00:19:37,120 --> 00:19:41,180
I'm leaving a link to this in the show notes so that you guys can see the PDF yourself.

345
00:19:41,520 --> 00:19:47,300
If you have expertise, if you have a personal opinion that is genuinely productive and can

346
00:19:47,500 --> 00:19:53,040
be useful, I encourage you to share that before June 25th so that it can actually be, hopefully,

347
00:19:53,200 --> 00:19:56,240
in some way, shape, or form taken into consideration.

348
00:19:57,300 --> 00:19:58,580
That is all I have to say about this story.

349
00:19:59,160 --> 00:20:01,560
Now we're going to get into the defense bulletin.

350
00:20:07,580 --> 00:20:08,540
Starting with the data breaches.

351
00:20:08,740 --> 00:20:10,680
These are just random breaches from the last week.

352
00:20:11,179 --> 00:20:12,440
DentaQuest was hit with a data breach.

353
00:20:12,700 --> 00:20:14,320
This is a dental insurance company.

354
00:20:14,460 --> 00:20:16,360
So if you use this, you should look into it.

355
00:20:16,420 --> 00:20:18,100
It actually has to do with the Shiny Hunters gang,

356
00:20:18,560 --> 00:20:20,300
which has been making tons of rounds lately.

357
00:20:20,700 --> 00:20:23,280
So check it out if you want to learn more in the show notes.

358
00:20:23,740 --> 00:20:29,780
Up next, we have the UN Food Agency, which has disclosed a breach affecting 600,000 Gaza households.

359
00:20:30,340 --> 00:20:32,460
So this is the World Food Program, WFP.

360
00:20:32,820 --> 00:20:36,720
They disclosed this incident in a Sunday Telegram message, that's a first,

361
00:20:37,340 --> 00:20:41,660
saying that the self-registration application used for assistance registration in Gaza had been breached,

362
00:20:42,040 --> 00:20:42,700
which is a bit sad.

363
00:20:42,800 --> 00:20:45,920
It's already a very tough subject to navigate,

364
00:20:46,040 --> 00:20:49,080
and now having to deal with a data breach on top of that is very difficult.

365
00:20:49,160 --> 00:20:51,000
They leaked a lot of sensitive information.

366
00:20:51,160 --> 00:20:55,260
And so if you in any way are involved with this, you should look into it in the show notes.

367
00:20:55,600 --> 00:21:00,920
There's a company called ServiceNow, which based on a quick search is like an AI agentic thing.

368
00:21:01,700 --> 00:21:04,520
But they've disclosed a security incident exposing customer data.

369
00:21:04,640 --> 00:21:10,280
And so if you or a company or someone you know uses this kind of tool, you need to point them this direction.

370
00:21:10,480 --> 00:21:12,480
And again, links to everything are in the show notes.

371
00:21:12,560 --> 00:21:15,260
I'm not going to say it again because I keep saying it on every story.

372
00:21:16,140 --> 00:21:18,980
Next one is Sofi, Sofi, S-O-F-I.

373
00:21:19,340 --> 00:21:22,500
has confirmed a third-party data breach at their Hong Kong subsidiary.

374
00:21:22,810 --> 00:21:25,700
So if you know anyone who is involved with this, definitely check it out.

375
00:21:26,040 --> 00:21:27,220
I didn't know where to put this this week.

376
00:21:27,450 --> 00:21:30,660
I was almost going to make it a main story, but there wasn't enough juice.

377
00:21:31,260 --> 00:21:33,320
Wasn't enough squeeze in the juice.

378
00:21:33,520 --> 00:21:34,640
You guys know what I'm trying to say.

379
00:21:35,520 --> 00:21:38,720
But I also didn't know if I should put it in data breaches or threats.

380
00:21:38,980 --> 00:21:40,200
So I'm just putting it here.

381
00:21:40,780 --> 00:21:42,560
But Dashlane, this is a highlight story recently,

382
00:21:43,040 --> 00:21:46,620
had a data breach where 20 password vaults were breached.

383
00:21:46,780 --> 00:21:49,300
And actually, we now finally have a lot more information.

384
00:21:49,500 --> 00:21:53,220
Pretty much, they just tried to brute force through API endpoints for device registration.

385
00:21:53,780 --> 00:21:55,700
And they tried to send a lot of automated requests.

386
00:21:56,220 --> 00:22:00,020
Their automated security system actually triggered an automatic lockout.

387
00:22:00,080 --> 00:22:06,680
But they still, before that was fully mitigated, still led to 20 personal customers from getting their vault stolen from them.

388
00:22:06,760 --> 00:22:11,020
Now, the good news is that Dashlane, unlike LastPass, doesn't have any unencrypted fields.

389
00:22:11,520 --> 00:22:12,800
So everything is encrypted.

390
00:22:13,200 --> 00:22:18,520
And it uses an algorithm called Argon2, which is a much more secure version of password security.

391
00:22:18,670 --> 00:22:23,940
And so I will say, you know, based on Dashlane's initial responses, which were quite weak,

392
00:22:24,320 --> 00:22:29,080
this is looking a lot better for Dashlane and is representing a much better overall security

393
00:22:29,390 --> 00:22:32,480
posture than what LastPass demonstrated in their 2022 data breach.

394
00:22:32,690 --> 00:22:34,820
So I'm a bit happier to see this.

395
00:22:35,190 --> 00:22:38,799
But even then, if you are one of those people, which Dashlane would have contacted you if

396
00:22:38,780 --> 00:22:44,200
you were, if you're one of those 20 people, your vault is completely dependent. Yes, it has Argon,

397
00:22:44,250 --> 00:22:48,740
it has all these cool things, it's all encrypted, but you know, it's still up to whether or not you

398
00:22:48,800 --> 00:22:52,980
had a strong master password. So if you are one of those 20 people and the complete off chance you're

399
00:22:53,040 --> 00:22:57,060
one of those people and you listen to this podcast and just change all of your passwords and assume

400
00:22:57,160 --> 00:23:01,260
that everything in there is compromised. So if you have any cryptocurrency in there, you should

401
00:23:01,600 --> 00:23:06,460
probably move it to a different wallet, all that kind of stuff. That's my recommendation to you.

402
00:23:06,740 --> 00:23:11,060
Otherwise, interesting and probably not as devastating as this could have been for Dashlane.

403
00:23:11,150 --> 00:23:13,140
And I'm happy that they finally included more details.

404
00:23:13,660 --> 00:23:17,620
Oxford University has disclosed a data breach after careers platform hack.

405
00:23:18,040 --> 00:23:21,640
And so this is from their third party provider, but it impacts anybody who used it.

406
00:23:21,640 --> 00:23:24,140
And so definitely check this out if you want to learn more.

407
00:23:24,500 --> 00:23:27,760
This is an update to a story I covered last week, but it's pretty much just coverage that

408
00:23:27,790 --> 00:23:33,480
that really stupid, like genuinely stupid attack where Meta had an AI chatbot in Instagram,

409
00:23:33,840 --> 00:23:38,520
which allowed anybody to just ask the AI chatbot to get access to someone else's account.

410
00:23:38,720 --> 00:23:39,220
And it said, sure.

411
00:23:39,920 --> 00:23:44,700
Now, they've revealed now that over 20,000 Instagram users had their accounts hijacked

412
00:23:45,460 --> 00:23:46,740
using this exact system.

413
00:23:47,480 --> 00:23:48,500
It is unbelievable.

414
00:23:49,040 --> 00:23:52,080
And again, going back to, because also the highlight story was meta,

415
00:23:52,880 --> 00:23:54,880
this is just such a reckless company.

416
00:23:55,000 --> 00:23:58,620
So if you are putting anything that requires trust to this company,

417
00:23:58,880 --> 00:24:00,180
I would think twice about that.

418
00:24:00,340 --> 00:24:02,420
They do not care about your safety, period.

419
00:24:02,680 --> 00:24:04,280
It doesn't matter what product they're working on.

420
00:24:04,560 --> 00:24:07,040
They will find a way to screw it up, I swear.

421
00:24:07,640 --> 00:24:09,800
And now I'm going to move on because I can't deal with this anymore.

422
00:24:10,020 --> 00:24:13,220
The French government is the last data breach because they had a messaging service that was

423
00:24:13,420 --> 00:24:15,520
breached in an account hijacking attack.

424
00:24:15,860 --> 00:24:18,640
Now we're going to get into the threats, which is the next subsection.

425
00:24:18,780 --> 00:24:22,160
This is just things that I should put on your radar because it could impact your safety.

426
00:24:22,480 --> 00:24:26,200
So the first one is that Google has patched a new Chrome zero-day flaw exploited in the

427
00:24:26,340 --> 00:24:26,440
wild.

428
00:24:26,640 --> 00:24:31,020
And so if you use Chrome or any other Chromium-based browser, make sure you're staying up to date

429
00:24:31,040 --> 00:24:32,260
to get those zero-day patches.

430
00:24:32,700 --> 00:24:49,200
All right, we got more WordPress stuff as we do every week now, but there's an Everest Forms Pro, which I'm assuming is a plugin. Yep, Everest Forms Pro plugin had a vulnerability that was exploited to take over WordPress. And so if you use that, check it out and try to patch that up.

431
00:24:49,860 --> 00:24:55,560
Now, WhatsApp says that it caught new spyware attacks linked to NSO Group in violation of a court order.

432
00:24:56,120 --> 00:25:00,900
Now, this is nothing too new, but if you use WhatsApp, they should hopefully be notifying you.

433
00:25:00,900 --> 00:25:09,880
And it's important to mention that WhatsApp now has a new security feature to try to essentially do like Apple's lockdown mode, but within the WhatsApp ecosystem.

434
00:25:10,180 --> 00:25:11,860
It's called strict account settings.

435
00:25:12,070 --> 00:25:18,880
But if you are somebody who is a journalist or you have a higher threat model and you're forced to use WhatsApp for whatever reason, this is something to consider.

436
00:25:18,960 --> 00:25:21,820
if you are concerned about these government attacks against you.

437
00:25:22,260 --> 00:25:25,160
This is the continuing saga with Mr. Nightmare Eclipse,

438
00:25:25,520 --> 00:25:28,140
which we've been doing coverage for nearly every week now

439
00:25:28,300 --> 00:25:29,980
for the last four plus weeks.

440
00:25:30,740 --> 00:25:35,340
But this is a disgruntled security researcher slash person

441
00:25:36,080 --> 00:25:37,720
who pretty much just has, you know,

442
00:25:37,720 --> 00:25:39,740
they found all these Microsoft zero days.

443
00:25:40,200 --> 00:25:42,160
But this is just an update that Microsoft has released fixes

444
00:25:42,340 --> 00:25:43,780
for two high severity zero days

445
00:25:44,090 --> 00:25:45,840
that were disclosed by Nightmare Eclipse.

446
00:25:46,160 --> 00:25:47,920
So if you want to keep yourself safe from those zero days,

447
00:25:48,000 --> 00:25:52,580
you should get yourself updated. There was a UnifyOS bug that lets hackers gain root without

448
00:25:52,760 --> 00:25:58,280
authentication. So if you're using Unify, Ubiquity, etc., check that out to learn more.

449
00:25:58,840 --> 00:26:02,560
We also had GOGS that has patched a critical zero-day enabling remote code execution. I

450
00:26:02,860 --> 00:26:07,460
believe we covered this last week, if I'm not mistaken, but get that updated if you use GOGS.

451
00:26:07,700 --> 00:26:13,379
There's also another new supply chain attack called Ironworm, which is a piece of malware that

452
00:26:13,400 --> 00:26:19,040
now have infected 36 packages on the NPM index with InfoStealers. If you are using any of these,

453
00:26:19,200 --> 00:26:23,560
you need to keep up with this because it's quite devastating and we're seeing new stuff every week.

454
00:26:23,760 --> 00:26:29,840
Now, similarly, hackers have compromised 19 packages on PyPy. So things like Dynamo, Spadio,

455
00:26:30,400 --> 00:26:34,800
Coolbox, Ufish, Napari Ufish. I don't know what these things are. I don't use these, but

456
00:26:35,180 --> 00:26:39,999
these are just some of the infected packages. Another supply chain attack. It's crazy because

457
00:26:40,020 --> 00:26:44,620
The supply chain attacks normally are a bit more rare, but we've been seeing them just nonstop.

458
00:26:45,110 --> 00:26:53,980
But this supply chain attack hit Ola browser, H-O-L-A, and pretty much the Windows version was completely compromised to deliver a crypto miner.

459
00:26:54,360 --> 00:26:59,140
So if you use this service, dig into the story because it's quite a serious thing that you should look into.

460
00:26:59,540 --> 00:27:02,460
Now, I recently just talked about how WhatsApp has that strict account settings.

461
00:27:02,690 --> 00:27:03,640
We have lockdown mode.

462
00:27:03,780 --> 00:27:07,440
Google has their advanced protection program, and I think it's Android advanced protection on Android.

463
00:27:07,860 --> 00:27:10,860
Now we have another one to join these more advanced security settings,

464
00:27:11,370 --> 00:27:14,080
which is OpenAI unveiling lockdown mode.

465
00:27:14,280 --> 00:27:15,920
And they're using the same name because they're unoriginal

466
00:27:16,050 --> 00:27:19,740
and they probably asked ChatGPT for what to call it.

467
00:27:20,440 --> 00:27:23,980
But this is to help prevent prompt injection attacks.

468
00:27:24,500 --> 00:27:28,160
It'll also disable live web browsing so you can only access cached content.

469
00:27:28,880 --> 00:27:30,820
The retrieval and display of images from the web,

470
00:27:31,510 --> 00:27:34,480
deep research and agent mode as well be in some way restricted.

471
00:27:34,860 --> 00:27:36,260
It says it's not intended for everyone.

472
00:27:36,480 --> 00:27:42,880
It is designed for people and organizations that handle sensitive data and want stricter protection from data exfiltration risks related to prompt injection.

473
00:27:43,700 --> 00:27:48,680
So I guess if you are and you have to use ChatGPT for whatever reason, this is another tool to throw your way.

474
00:27:48,960 --> 00:27:50,200
This one is bizarre.

475
00:27:50,620 --> 00:27:54,060
I mean, I would not, this was not on my 2026 bingo card to say the least.

476
00:27:54,240 --> 00:27:56,680
But so WWDC had a lot of stuff.

477
00:27:57,060 --> 00:28:03,400
But one of the things that was really interesting is they have these new AI features they're rolling out into the Apple ecosystem, which are going to be polarizing at best.

478
00:28:04,080 --> 00:28:08,880
And one of them is an AI agentic feature.

479
00:28:09,620 --> 00:28:11,240
So if you use Apple passwords,

480
00:28:12,800 --> 00:28:15,440
it'll actually see that you have a weak password

481
00:28:15,720 --> 00:28:19,660
and automatically change it to become a secure password.

482
00:28:19,880 --> 00:28:22,960
I would love to see how this works, if it works.

483
00:28:23,700 --> 00:28:24,720
It's an interesting concept

484
00:28:24,960 --> 00:28:26,700
and it would actually probably overall

485
00:28:27,000 --> 00:28:28,320
keep maybe people a bit safer,

486
00:28:29,220 --> 00:28:30,120
but there's a lot of ifs.

487
00:28:30,300 --> 00:28:31,420
I'm a little skeptical,

488
00:28:31,820 --> 00:28:33,620
but I put it in here because it's interesting.

489
00:28:34,120 --> 00:28:43,480
And then the final threat of the week is 404 quickly covered this company called Signal Trace that is going to add phone, AirPod, and smartwatch trackers to their license plate readers.

490
00:28:44,080 --> 00:28:44,880
Very creepy stuff.

491
00:28:45,040 --> 00:28:52,120
It's using things like Bluetooth and other data to try to link even more information to people who are just living and existing in public.

492
00:28:52,660 --> 00:28:55,360
So if you want to learn more, check out 404 to learn more about that.

493
00:28:55,840 --> 00:28:58,300
Now, we have a lot of fun open source news this week.

494
00:28:58,450 --> 00:29:00,140
So we're going to get into the FOSS Plus updates.

495
00:29:00,800 --> 00:29:02,660
FOSS, FOSS adjacent, source available.

496
00:29:03,620 --> 00:29:05,960
open standard, whatever you want to call it.

497
00:29:06,100 --> 00:29:08,540
It's supposed to be a fun little way to finish the podcast.

498
00:29:08,880 --> 00:29:11,180
So Tails released version 7.8.1.

499
00:29:11,260 --> 00:29:13,340
This is the anonymous ephemeral operating system,

500
00:29:13,490 --> 00:29:15,440
and it mostly includes a fix to a security vulnerability.

501
00:29:16,220 --> 00:29:19,880
Otherwise, I don't see any kind of like major feature updates,

502
00:29:19,910 --> 00:29:21,980
but make sure to get updated if you're using Tails.

503
00:29:22,540 --> 00:29:23,840
This is a bit more of a technical one,

504
00:29:23,840 --> 00:29:28,160
but Firefox has merged support for Vulkan video decoding.

505
00:29:28,500 --> 00:29:32,680
This is exciting because it means if you use things like NVIDIA or something on Linux,

506
00:29:32,920 --> 00:29:34,620
you're probably going to get better video playback

507
00:29:34,830 --> 00:29:37,020
and have better compatibility with Linux drivers,

508
00:29:37,560 --> 00:29:38,720
graphics drivers specifically.

509
00:29:38,950 --> 00:29:41,880
I know there's probably a weirdly high amount of people

510
00:29:42,120 --> 00:29:44,100
listening to this podcast that this might actually impact,

511
00:29:44,380 --> 00:29:46,140
even though the regular world would see this

512
00:29:46,140 --> 00:29:48,120
as a crazy niche technical thing.

513
00:29:48,540 --> 00:29:49,640
I think for a lot of you listening,

514
00:29:49,780 --> 00:29:51,080
this might actually impact you.

515
00:29:51,400 --> 00:29:53,120
This is a quick update to Firefox VPN.

516
00:29:53,410 --> 00:29:56,860
They released it with 50 gigabytes of pretty much bandwidth

517
00:29:56,970 --> 00:29:57,760
and it's completely free.

518
00:29:57,790 --> 00:29:59,960
I actually interviewed literally the head of Firefox

519
00:30:00,340 --> 00:30:01,680
on Techlore Talks, our sister podcast.

520
00:30:02,000 --> 00:30:05,340
So if you want to learn more about the threat model, how this is different from Mozilla VPN,

521
00:30:05,620 --> 00:30:08,080
I asked all those questions so I can learn more about it.

522
00:30:08,440 --> 00:30:13,300
But they just announced that they are going to be making it unlimited for a limited time.

523
00:30:13,640 --> 00:30:16,840
From now through August 31st, they are just straight up going to make it unlimited.

524
00:30:17,120 --> 00:30:19,800
So I guess if you haven't played around with it yet, try it out.

525
00:30:20,100 --> 00:30:21,680
It's actually pretty sound.

526
00:30:21,840 --> 00:30:24,340
And I think it's good for especially beginners who don't use anything.

527
00:30:24,840 --> 00:30:30,340
It's a good way to dip their toes into something that's free and actually isn't bad from a privacy perspective.

528
00:30:30,740 --> 00:30:33,420
All right, Nextcloud Hub 26 is here.

529
00:30:33,660 --> 00:30:35,700
This is a really exciting time to be a Nextclouder

530
00:30:36,020 --> 00:30:38,580
because this is their 10-year anniversary, I believe.

531
00:30:39,500 --> 00:30:40,800
So it's their anniversary release,

532
00:30:41,160 --> 00:30:42,460
plus they have EuroOffice stuff,

533
00:30:42,660 --> 00:30:44,480
plus they have just the typical exciting updates.

534
00:30:45,220 --> 00:30:46,360
It's got design updates.

535
00:30:46,760 --> 00:30:49,580
And now you can choose between having Nextcloud Office

536
00:30:49,760 --> 00:30:52,760
being powered by Collabora or EuroOffice.

537
00:30:52,920 --> 00:30:55,600
I'm looking at these screenshots of EuroOffice right now,

538
00:30:55,640 --> 00:30:57,180
and if you're watching the video, you can see them.

539
00:30:57,320 --> 00:30:59,260
And I gotta say, it looks pretty fire.

540
00:30:59,560 --> 00:31:01,120
So I think that's pretty cool.

541
00:31:01,420 --> 00:31:04,580
There are, as always, a bajillion things that are new.

542
00:31:04,920 --> 00:31:07,680
So if you are using NextCloud, check it out.

543
00:31:07,700 --> 00:31:10,200
On a similar note, if you don't like NextCloud for whatever reason,

544
00:31:10,540 --> 00:31:13,340
or you prefer something that's just hosted and out there for you,

545
00:31:13,760 --> 00:31:15,260
Proton has ProtonDrive updates.

546
00:31:15,460 --> 00:31:18,780
So it's now supposedly three times faster on all platforms

547
00:31:18,920 --> 00:31:20,360
with two times faster downloads.

548
00:31:20,700 --> 00:31:24,040
Now, they also have ProtonDrive CLI coming to your terminal,

549
00:31:24,300 --> 00:31:26,360
which is also available on Linux,

550
00:31:26,560 --> 00:31:28,860
which I think is actually a really good step forward.

551
00:31:29,240 --> 00:31:33,780
People have been begging for the ProtonDrive Linux client for years now, as have I, and

552
00:31:33,860 --> 00:31:34,620
I've seen all the comments.

553
00:31:35,200 --> 00:31:38,820
And they even say we are developing their fully featured Linux app as well.

554
00:31:39,160 --> 00:31:43,080
The CLI already allows you to script a lot of ProtonDrive's key features from your favorite

555
00:31:43,280 --> 00:31:43,880
scripting environments.

556
00:31:44,360 --> 00:31:47,580
So I think that they even say it's not a full replacement, but I think the fact that we

557
00:31:47,740 --> 00:31:51,640
have a ProtonDrive CLI for Linux is huge, all right?

558
00:31:51,740 --> 00:31:53,120
That's already like almost there.

559
00:31:53,180 --> 00:31:56,560
And I think that the GUI and everything should come shortly after, I'm hoping.

560
00:31:56,920 --> 00:31:58,580
I don't have any insider information on this,

561
00:31:58,720 --> 00:32:01,140
so I'm kind of just giving you my observations

562
00:32:01,330 --> 00:32:02,280
based on the blog articles.

563
00:32:02,690 --> 00:32:04,740
All right, Fudo Keyboard is introducing

564
00:32:05,000 --> 00:32:06,460
more accurate swipe typing,

565
00:32:06,860 --> 00:32:08,700
Unicode 17 emoji support, and more.

566
00:32:08,860 --> 00:32:10,100
A lot of you have told me directly

567
00:32:10,170 --> 00:32:11,200
that you love the Fudo Keyboard,

568
00:32:11,320 --> 00:32:12,140
and that's what you use.

569
00:32:12,540 --> 00:32:13,940
And so make sure to get yourself updated

570
00:32:14,100 --> 00:32:15,480
if you want those benefits.

571
00:32:15,920 --> 00:32:17,800
Brave has officially released Origin

572
00:32:18,060 --> 00:32:20,020
for a paid bloat-free browsing experience.

573
00:32:20,460 --> 00:32:23,480
I did a whole review of Brave Origin.

574
00:32:23,570 --> 00:32:24,660
If you want to check that out,

575
00:32:24,920 --> 00:32:25,839
it's going to be as a card

576
00:32:25,860 --> 00:32:26,920
as well as in the show notes.

577
00:32:27,340 --> 00:32:28,900
So I've already done a ton of coverage for this

578
00:32:29,020 --> 00:32:30,700
and what the $60 browser looks like,

579
00:32:30,850 --> 00:32:31,820
whether or not you should use it.

580
00:32:32,000 --> 00:32:32,860
The next article is from

581
00:32:32,890 --> 00:32:34,460
the Free Software Foundation of Europe

582
00:32:34,610 --> 00:32:35,460
and they've come forward

583
00:32:35,660 --> 00:32:37,300
and they've said that EU tech sovereignty

584
00:32:37,640 --> 00:32:39,740
is a big milestone for public code.

585
00:32:39,920 --> 00:32:41,920
So they have this overall concept

586
00:32:42,260 --> 00:32:44,060
that is called public money, public code.

587
00:32:44,090 --> 00:32:46,180
It means if you are a taxpayer

588
00:32:46,540 --> 00:32:48,140
and you're contributing to a public service

589
00:32:48,340 --> 00:32:48,800
like a government,

590
00:32:49,200 --> 00:32:50,360
it should also have public code

591
00:32:50,440 --> 00:32:51,580
that you can verify and inspect

592
00:32:51,740 --> 00:32:53,220
and make sure it's actually working for you.

593
00:32:53,620 --> 00:32:55,179
I think it's a very simple concept

594
00:32:55,200 --> 00:32:57,100
that a lot of open source advocates will get behind,

595
00:32:57,260 --> 00:32:59,020
but I think everybody should get behind this.

596
00:32:59,160 --> 00:33:00,600
This is an update that just commends

597
00:33:00,720 --> 00:33:02,540
the European Commission's explicit recognition

598
00:33:02,920 --> 00:33:04,920
of this public money, public code campaign.

599
00:33:05,360 --> 00:33:07,140
Now they do still say that the commission

600
00:33:07,280 --> 00:33:08,920
still falls short on concrete goals,

601
00:33:09,420 --> 00:33:11,580
milestones, and secure funding for free software,

602
00:33:12,020 --> 00:33:13,820
but the procurement reform will be a test.

603
00:33:13,940 --> 00:33:15,640
Public money, public code must become

604
00:33:15,680 --> 00:33:17,540
a mandatory requirement for public tendering.

605
00:33:17,840 --> 00:33:19,580
And Lucas from the Free Software Foundation of Europe,

606
00:33:19,720 --> 00:33:22,080
who I've also interviewed on our podcast, Tackler Talks,

607
00:33:22,120 --> 00:33:23,540
so definitely check that out if you want to learn more.

608
00:33:23,620 --> 00:33:24,700
He was a brilliant guest.

609
00:33:25,240 --> 00:33:29,520
but he also talked about what matters now is implementation these commitments need secured

610
00:33:29,760 --> 00:33:33,200
long-term funding meaningful involvement of independent experts and civil society

611
00:33:33,620 --> 00:33:37,540
and effective enforcement of the dma to ensure free software can can thrive in a fair market

612
00:33:37,860 --> 00:33:41,600
so if you want to learn more this is a great article and a great recap of what's going on

613
00:33:41,720 --> 00:33:47,040
in europe's open source scene right now and now we have the last open source story of the week so

614
00:33:47,340 --> 00:33:52,919
this is a brand new app that came from a security researchers named misc is who they're known as

615
00:33:52,940 --> 00:33:55,820
They released an app called Loop, L-O-U-P-E.

616
00:33:55,960 --> 00:33:57,060
It's completely open source.

617
00:33:57,360 --> 00:34:00,400
And what it does is for iPhone, iPad, Apple users,

618
00:34:00,700 --> 00:34:02,140
essentially mobile Apple users,

619
00:34:02,740 --> 00:34:05,320
it literally just tells you what apps really know about you.

620
00:34:05,440 --> 00:34:06,580
It's very demonstrative.

621
00:34:07,180 --> 00:34:08,320
And you just download the app.

622
00:34:08,360 --> 00:34:10,139
It keeps all the data inside of the app.

623
00:34:10,179 --> 00:34:10,980
And it just says, hey,

624
00:34:11,399 --> 00:34:13,760
I noticed that you probably have Signal installed on your phone.

625
00:34:13,919 --> 00:34:15,139
You have Proton installed on your phone.

626
00:34:15,280 --> 00:34:16,700
Oh, you have these recent locations.

627
00:34:16,860 --> 00:34:18,399
It pretty much goes through everything

628
00:34:18,560 --> 00:34:20,300
that a random app can install on your phone,

629
00:34:20,399 --> 00:34:23,720
all without even having a single app permission granted.

630
00:34:24,179 --> 00:34:25,399
So it breaks things up between

631
00:34:25,800 --> 00:34:27,480
what is just passive data collection

632
00:34:27,700 --> 00:34:29,820
versus what you can grant access to to certain apps.

633
00:34:30,260 --> 00:34:32,600
But this is such a powerful educational tool.

634
00:34:32,659 --> 00:34:34,780
And so I recommend you guys download this yourself.

635
00:34:35,120 --> 00:34:35,720
It's completely free.

636
00:34:35,940 --> 00:34:36,580
It's open source.

637
00:34:36,860 --> 00:34:37,760
I played around with it.

638
00:34:37,760 --> 00:34:38,659
It was very interesting.

639
00:34:39,060 --> 00:34:40,600
And I even recorded a quick video

640
00:34:40,860 --> 00:34:43,000
to actually break it down a little more formally.

641
00:34:43,040 --> 00:34:45,300
So that video should be going live in the next week or so

642
00:34:45,659 --> 00:34:46,659
if you guys want to see it.

643
00:34:46,940 --> 00:34:48,820
But I think this is a perfect recommendation

644
00:34:49,000 --> 00:34:50,139
to share with friends and family.

645
00:34:50,280 --> 00:34:51,919
and people who don't really understand

646
00:34:52,139 --> 00:34:54,639
just how invasive downloading a native app can be.

647
00:34:54,980 --> 00:34:57,040
All right, everybody, it was a long week this week.

648
00:34:57,110 --> 00:34:58,940
There were, I think, over 50 stories.

649
00:34:59,320 --> 00:35:00,880
So thank you all for sticking with me.

650
00:35:00,970 --> 00:35:02,040
And that's going to conclude

651
00:35:02,660 --> 00:35:04,460
this week's Techlore Surveillance Report.

652
00:35:04,760 --> 00:35:06,480
If this analysis helped you reclaim control,

653
00:35:06,900 --> 00:35:07,880
you can become a Techlorian

654
00:35:08,020 --> 00:35:09,400
by visiting a link in the show notes.

655
00:35:09,410 --> 00:35:11,020
We couldn't do it without your guys' support.

656
00:35:11,540 --> 00:35:13,560
You also gain access to the private communities

657
00:35:13,840 --> 00:35:15,320
like Signal that we have access to.

658
00:35:15,350 --> 00:35:16,300
And you also get key perks

659
00:35:16,480 --> 00:35:17,840
like my private RSS feed

660
00:35:17,900 --> 00:35:19,120
that I'm updating throughout the week

661
00:35:19,260 --> 00:35:20,000
with all of these stories.

662
00:35:20,200 --> 00:35:22,760
so you don't have to wait till Wednesday to get the full episode.

663
00:35:22,940 --> 00:35:24,420
You can just track my RSS feed,

664
00:35:24,720 --> 00:35:26,320
and then you don't have to track all the other ones yourself.

665
00:35:26,680 --> 00:35:29,080
If you don't want to financially support things, totally cool.

666
00:35:29,300 --> 00:35:30,320
You can also leave a rating.

667
00:35:30,440 --> 00:35:33,820
You can share the episode to still spread all this information with people you know.

668
00:35:34,320 --> 00:35:35,740
Either way, I want to thank you all for listening,

669
00:35:35,940 --> 00:35:39,560
and I'll see you in the next episode of Surveillance Support in two weeks.

670
00:35:39,700 --> 00:35:42,100
And don't forget to check out our sponsor this episode, Davaik,

671
00:35:42,160 --> 00:35:44,220
and I want to thank them as well for making this possible.

672
00:35:44,720 --> 00:35:46,240
See you all next time on Techlore.