This week's surveillance support covers OpenAI's rogue AI agent hacking far more than just
hugging face and actually a similar thing now happening to Anthropic, Iran linked hackers
burrowing into dozens of US water systems, an activist prosecuted for wiping his number
at the border, and thousands of private claw chats exposed on Google.
A bit of an AI heavy week this week, plus our normal data breaches, threats, FOS Plus
updates, open source.
Welcome to the Techlore Surveillance Report, everybody, your essential weekly tech news
delivering the deep analysis on the latest threats to security, privacy, and digital freedom,
and of course, empowering you to reclaim control and defend your rights as we go along.
I'm excited this week, no announcements really, so let's just dive into the fun stories.
Following this one has been a bit of a nightmare, actually, because the story and my analysis
on it continues to change over time.
OpenAI, the company behind ChatGPT, pretty much set up what was supposed to be sandboxed
environment, which was not properly sandboxed and made it easy to escape. And then that model
essentially started attacking different things around the internet. The main highlight being
Hugging Face, which is another AI organization. The original story is that, oh my god, this rogue
AI agent from OpenAI escaped its, you know, its boundaries from a testing environment and just
started hacking the world. And it just kind of like snapped its fingers and made it happen.
But as we learn more details, it looks less that way.
And when we see these attacks, it's important to remind, especially the new listeners out there,
a lot of people think that it's like the movies where, you know, you just put in a command into your terminal and boom, you hacked someone and that's done.
I think a lot of people know it's not that simple.
But for attacks like these, I think what people don't appreciate, like when I'm talking to people around me,
is the amount of steps required to get to that final destination.
Like let's say even if that one terminal line hack thing actually works that way, you would have to do that multiple times to finally get where you want to go.
And of course, we all pretty much know it's not just a one command kind of thing.
And so it's the kind of thing of scouring the internet for publicly available credentials for certain user accounts that have access to certain information.
They then found some specific zero days.
They found specific bugs and all these things piled on top of each other to finally give them access.
And we've seen attacks like this from humans too.
I think really what's new here is the fact, well, it wasn't done by a human, one, but also it was just faster.
You know, it was more offensive.
It might work a little bit faster than a human might.
Ars Technica had this great article where they came forward making a pretty compelling argument that this isn't the triumph it was made out to be.
When these headlines came out, you know, these AI companies, I think what's really hard to figure out when we're doing coverage for this,
and when I say we, I mean just as a society,
is what is hype and what is reality?
And I think these AI companies,
even when negative things happen,
they're still incentivized to paint them in a positive way.
So that's kind of the hidden dark side here.
When OpenAI says, oops, we hacked someone,
it's like, wait, we hacked someone.
That's how good our models are, right?
That's pretty cool.
So it makes it really hard to actually analyze the coverage.
And in this case specifically,
both companies were actually incentivized by the same thing
when you think about it from a PR perspective.
Open AI is incentivized to say,
wow, our model is just so good.
Look at what it did.
And it was just so out of control.
It was so good that it wasn't even our fault.
And then you have also Hugging Face,
who actually made a lot of very simple mistakes
that could have prevented this attack,
which also a human could have exploited
now that we know more of the details.
And Hugging Face is also incentivized to say,
oh yeah, dude, this is like some novel, crazy thing.
Couldn't have been prevented.
They tried to spin the entire incident as a success story at Hugging Face because the security team treated OpenAI's report with the urgency it deserved as a genuine zero-day unknown to the world and moved accordingly.
Left out of the post is that five days passed until OpenAI revealed its role on the breach Hugging Face disclosed, and that at least another five days passed from the time OpenAI reported the zero-days and JFrog released patches for them.
So the lesson here is that if OpenAI agents can gain a 10-day head start, so too can other models being used maliciously.
This is hardly the success story Jfrog and OpenAI are trying to make it out to be.
Combined with Jfrog's opaqueness surrounding the zero days,
because they never actually shared what all the zero days were,
the incident looks even worse.
Given the speed at which AI companies are moving,
there may still be worse to come.
As the title promises, this is the story that keeps on giving.
Because right when you think, you know, that's it, you know,
this is still unfolding, we're getting more details,
we're maybe trying to figure out what this actually looks like,
what does it mean,
Anthropic now comes forward, who runs Claude and says,
oh, hey, by the way, RAI also hacked three companies during our tests.
Oh, my gosh.
This one's also a little bit more embarrassing in some ways
because two of the three organizations didn't even know
they were already accessed until Anthropic had to tell them.
So it's not the, like, we caught it fast story
that we kind of got on the other end of things.
And also, Mythos literally uploaded a malicious Python package
to a public registry, which compromised 15 machines in the process.
So, of course, I always like to look at, well, what's the intent behind, you know, publicizing
this?
And I guess it's for me, it's a 50-50 thing.
I think this could be the kind of thing where it's like, oh, my God, OpenAI is getting a
lot of both good and bad press about how their models are so good.
And they just hack things and it might look Claude not look as good.
So Claude's going to say, yeah, we can hack things, too.
I also think it's equally likely, though, that they and this is actually what they reported
themselves, this whole incident with open AI forced them to start looking at their own logs,
and they actually discovered that their models are doing the same thing. I don't know what the truth
is, guys. That's why, again, it's very frustrating covering these AI companies because they oftentimes
aren't grounded in reality. And this is kind of my thoughts on these AI companies as a whole.
They themselves claim that AI is out to end humanity while they're building the AI themselves.
And so for me, I think that there's actually a lot of weird incentives for these AI companies to
create fear, to create this idea of how powerful these things really are that actually go beyond
what they realistically are, which is pattern recognition machines. I'm not saying these
aren't powerful machines. We use some of them back here too for some of our content and like
fact checking our scripts and helping us with transcripts. So we do use them back here. But
I think it's really important to understand that these things are so far from what I've been able
to tell, just doing things that humans can do much faster and much more efficiently, right?
One of the stories last week covering this even made the claim, I believe it was from TechCrunch, that this was not at all an AI problem.
It was a human problem because the humans didn't even put proper safeguards in place for this tool.
I see this as blaming construction equipment for just doing what it's designed to do.
But, you know, you are bulldozing the wrong building.
And it's like, well, maybe the human shouldn't have put that next to the wrong building.
So I have a lot of complicated feelings about this.
This is still unfolding.
I'm not an AI expert or anything.
This is just me doing my best to try to make sense of these stories.
So let me know what you guys think if you're on Spotify or YouTube, I suppose, or PeerTube,
Techlore.tv.
Coming soon, we have an activist who is facing a felony for wiping his graphene phone at the
border.
And then we also have thousands of private clod chats and artifacts getting indexed by
Google.
So we will touch on AI again for just a brief second.
But before we get there, the U.S. government says that Iran-linked hackers are disrupting
American water and energy providers.
Now, I like to share this story with people in any story like this because it's very common
for us to cover things that are a little bit more hypothetical and more, let's just say,
in the cloud and not as, you know, in your hands, something you can feel.
And that is kind of the inherent downside of covering security issues, right?
When you say something was caught in a data breach, it just feels a bit nebulous to a
lot of people.
But I love stories like this, obviously not because it's good for people, like this is an awful story, but it reminds people in a very healthy way that these systems do eventually reach the real world, right?
There was an advisory updated Wednesday that the FBI and the NSA, the Department of Energy and SISA, said that Iranian hackers were targeting programmable logic controllers on Internet-connected operational networks, allowing them to manipulate data on their displays, causing outages and disruption, specifically really looking at water and energy providers.
Now, originally, this was sent to a group which shares cybersecurity information called the Water Information Sharing and Analysis Center.
There's something for everything.
And they note that the Minnesota Fusion Center, which is a state-level intelligence sharing entity, issued an alert regarding ongoing malicious cyber activity impacting public drinking water systems across Minnesota.
This disrupted over 30 communities.
It's pretty scary stuff when you think about it.
And again, I like these stories because it grounds a lot of the stuff we talk about on this podcast in reality.
Now this clearly has some intense geopolitical ties right now with what's going on in Iran,
and that could explain why there could be some targets happening on U.S. soil with things that
are cyber attacks. So there's a lot going on here, and I'm not going to get too much into that side
of the story. So I like to remind people about what does prepping look like? What would it look
like if someone took out your power for a few days? What would it look like if you lost water access
for a couple days? Do you have backup water at home? These are the things I like to ask, and it's a
good thing for you to think about because you never know what's going to happen.
This is going to be an especially challenging one. You know, in the Signal group, I kind of
exchanged some messages with some of you guys, which is good because then I got some of your
feedback and thoughts, which helped me kind of form my thoughts on this one. So, you know,
the story itself before I dive into any analysis. So there's an individual here. His name is Samuel
tunic, tunic, tunic. And he runs graphene on his Pixel, and it's something that he uses.
He's an activist, part of a group called Defend the Atlanta Forest, which opposed the construction
of an enormous law enforcement training facility in the area often known as Cop City. What he didn't
know, according to his lawyers, was that he'd been placed on a watch list for his actions and that
Customs and Border Protection had discussed over email plans to detain him upon his arrival
back in the U.S. for suspected terrorism activities.
And ours here actually kind of downplays
what that looks like.
So they had a hidden camera that was placed
outside the house that he lived in.
They also had a tracker placed on his car.
They learned that his cell phone records were subpoenaed,
and he said he got an email from Google
saying his Gmail account had also been subpoenaed.
Apparently, he also tried to get a job
at a Christmas tree lot,
which required a background check.
But because it was going to be near public schools,
for some reason he failed the background check
so there's a lot of weird things happening here with very few details
and I just it makes it difficult to cover the story because we can't know
I know a couple other people have done coverage for the story say that oh those things are made up to make him look bad
and other people have said oh this guy's clearly up to something no good
that's why he's being investigated we don't know that's the reality
and so I wanted to at least share those details and so that way
you guys at least have all the facts of the story. Now, I also want to step back here a little bit
because I think there was a piece of news last week that actually fits into this one, and it has to do
with a case called U.S. v. Belmont Cardozo. Cardozo, I believe is how you say that. The Fourth Amendment
requires that government searches of persons or property be reasonable, which usually means
obtaining a warrant based on probable cause from a judge. But a warrantless search can still be
reasonable if it falls within an exception to the warrant requirement, including the exception that
allows officers to search your belongings at the border. The border search exception allows
warrantless searches of persons and property crossing the U.S. border, including the functional
equivalent of the border, such as international airports, given the government's interest in
controlling who or what may enter the country. And it says right here, until a clear line is drawn,
border officers within the Fourth Circuit's jurisdiction can use manual searches to sidestep
heightened Fourth Amendment standards that would authorize apply. And that is kind of the gap that
the EFF disagrees with existing. But that whole story I just shared with you is eerily similar
to what actually happened to this individual. So this individual was being watched by the FBI for
the year, just like I told you, Samuel Tunick. And he traveled outside of the US. And when he was
coming home, he had his graphene phone. They started asking him to unlock it. And they used
the duress password for graphene, which means they typed in a password, which reset the device.
And when I say reset, I mean wipe the device.
Now, his attorneys accused the government of demanding access to his phone under the pretext of searching for CSAM, but without providing evidence to justify its suspicion.
His motion to suppress argued that the government was instead investigating him over his association with a long-running environmental movement called Defend the Atlanta Forest, which opposes the development of a sprawling training campus for law enforcement in Atlanta dubbed Cop City.
So the prosecutor has charged him under a federal statute that makes it unlawful to knowingly destroy or damage property to prevent authorities from seizing it.
And he has pleaded not guilty.
There is this kind of expectation that when you are going over borders, you have less rights.
Now, I do think the duress thing is a very good lesson here because it is something that has been kind of discussed unofficially and kind of just communities online.
and I think it really represents how there's a lot of times a gap between kind of speculation
online and what the real world looks like. Now there is a quote here from somebody named Runa
Sanvik, who is a security expert who works to protect at-risk people. And she said,
I have not seen this before, though I've discussed this potential scenario with activists and
journalists over the years. I think this case serves as a reminder that authorities may argue
you knowingly destroyed data, so it's better to not have that data on you when you cross certain
borders. With a little planning ahead of time, you can always download the data you need once you get
where you're going. And this actually is pretty much what the advice has been that is a little bit
more applicable to more of you. And that's kind of the good news here. If you are really concerned
about border searches, you shouldn't be carrying a phone with your private data on it and travel
should be treated as its own thing. Get a burner phone, just get something with signal on it and
just add a few contacts to it. That way, if you're searched, you just give them your phone, let them
scan whatever they want. It's not a huge deal and you move on. But if you're traveling with all of
your normal data and you don't want to be, you know, victim to this, I would really recommend
just not bringing those devices before I would ever tell someone like, oh yeah, set up a duress
password. So just be very careful with that feature. Do your research. Make sure it actually
fits into your threat model and would actually help you when you try to imagine a very stressed
scenario inside of your workflow and your lifestyle. But this is a very interesting story.
This is still unfolding, and it should be interesting to see what happens here, because
this could set some precedent down the road for something else.
All right, everybody, coming soon, we have how thousands of private cloud chats and artifacts
got indexed by Google.
I wish I could somehow get some of my new tools properly indexed by Google, so maybe I could
get some of that magic sauce.
But before I get there, I want to share with you a bit about our sponsor today, which is
Dava Itch, D-A-W-A-R-I-C-H.
Half of today's episode is a story about someone else holding your data when it goes wrong,
like a rogue AI agent breaking into companies, hackers quietly sitting inside water systems,
a guy facing a felony over what was on his phone at the border.
The through line is one that we come back to literally every week on almost every story.
The danger wasn't the data itself, it's who's holding it and whether you're the one in control
and actually consenting to whatever's happening, which is the whole point of Dava Itch.
It's open source, optionally self-hosted location history app.
Basically, Google Timeline, except the map, actually belongs to you.
Import your existing Google data, and you can actually enjoy it, and then delete Google when you're done.
This is how you can track your cool rides, if you're going on rides, or your runs.
Really, anything. The sky's the limit, and the best part is you don't have to think about the privacy implications,
because, again, they're open source, and you can even self-host it yourself if you really want to trust only yourself.
Dava Itch really flips everything we see in these stories on its head,
because it gives you a superpower that only you own
and it puts you in the driver's seat.
So whether you're an athlete saving your favorite runs,
logging office days versus working from home for taxes,
documenting that road trip,
or you just want a year of your life
on a map that nobody else owns
that you can share with your friends and family,
you can self-host Dava Itch for free
or grab the hosted version at d-a-w-a-r-i-c-h.app
slash techlore.
Again, that's d-a-w-a-r-i-c-h.app slash techlore.
where the code Techlore gets you 20% off your first year.
All right, everybody, back to the show,
and thank you, Dava Itch, for sponsoring us.
Before we get into the Defense Bulletin,
we have one just very quick story also from AI companies,
specifically Claude.
Now, there's apparently an untold number of Claude chats and artifacts,
which is those mini apps and documents
that were found publicly searchable on Google over the weekend
And after a Reddit user discovered that a typing search operator like siteclaw.ai slash share into Google surfaced a long list of shared conversations.
Some reportedly contained health records, private company documents, and the names and phone numbers of children.
So let's use this story as a reminder.
If you're listening to this, just check through anything that you use that can implement sharing.
And just double check that what's shared is something that you still want to be shared.
It's these more obvious things that sometimes get skipped over.
when we look at all the technical stuff, we forget just the most obvious stuff sometimes.
Now, Anthropic has come forward and said, yeah, this is kind of the user's fault here.
The company said that shared links only appear in search results when they've been posted
somewhere search engines can see, like a forum or a social media post.
It added that a link sent privately to someone stays out of search, which honestly, I think
is pretty fair.
Like, it's a very fair take.
Like, this is a public link.
Klon is giving them the ability to go public.
Gosh, these autoplaying videos are so obnoxious.
So thank you, TechCrunch.
Again, I really think that what it seems like happened is it's a user error for the most part.
I'm not saying neither of these companies couldn't have done more to introduce safeguards here.
But I think a lot of users created this public link, maybe posted it online, forgot about it,
and now those are being indexed by Google because they were just found in public places.
Now, I use public links all the time, but only for things that I'm like,
okay, if this ends up in public hands, that's fine.
So just a reminder, and now let's get into the Defense Bulletin.
now the defense bulletin is broken up into three subsections the first is the data breaches the
second is the threats of the week so things to flag and the third one is the open source updates
so we're going to start here with data breaches starting with care cloud who's started to notify
hundreds of thousands after hackers stole medical records care cloud is a u.s health tech giant and
they said very little about the breach since March. Yes, this literally happened earlier this year
when it first admitted that hackers had raided one of its six stores of patient data.
But new disclosures seen by TechCrunch, though, offer the clearest picture of the breach so far,
including that nearly 350,000 people have been impacted. If anyone works for CareCloud,
do you just not give a damn? Like, guys, I just want to zoom out. Like, if you know this company
or you know someone involved with this company,
please check in with them.
They disclosed this in March with almost no information.
They have had no communication since then.
te reached out for comment
and they didn't respond for comment.
And we still have very limited information
on anybody who's impacted.
And might I remind you this impacts names,
home addresses, social security numbers,
government issued identification numbers
like passports and driver's licenses.
Notices also say that the stolen data
included financial information such as bank account information and payment card numbers
alongside a wealth of medical and health related information. I'm pretty pissed about this story
just reading it. So I'm going to move on. But check out the show notes if you want to learn more
to see what we do know about the story. Now South Korea has fined a telecom giant KT $39 million
for a customer data breach. And I believe we already covered this one if I'm not mistaken.
So the update here is the fine. So make sure to dig into this if you do or have used KT to make
sure you already dealt with that. But otherwise, just know that they were fined. Shiny Hunters has
claimed a Brinks home breach threatening to leak stolen data. Brinks is a home security company,
which has it looks like cameras and some kind of home ecosystem. We were seeing a lot of these
nowadays. But they have disclosed that hackers breached some of its systems and are threatening
to leak allegedly stolen data. They exfiltrated more than a million rows of customer data. They
support chat requests. So this is still unfolding. It's not looking great so far. So if you use
Brinks Home Security, check out the story and also make sure you're keeping up with any news
because they're going to start putting things out. Hopefully, if they're not the last company we
talked about, the first one I should say, because we talked about K, yeah, if they're not CareCloud,
they might actually communicate and actually care a little bit about their users. Obviously,
these are always ironic because this is a home security company and now they could jeopardize
your home safety a little bit, right? So I always like to point people as often as they can towards
things that are as close to zero knowledge as possible. Guys, when it's something this sensitive,
like I actually had a family member recently who just didn't think about it, right? Like they had
a home security camera that was an indoor security camera. And they started getting weird messages
from the local company about like things that were happening around the house. And it just didn't
click that, yeah, it's not zero knowledge. It's not end-to-end encrypted. So any employee can go
and watch that camera.
And so this is something people forget.
We hear companies like Google,
we hear companies like OpenAI,
we think of them as companies,
but they're made up by thousands of employees.
And those employees can have a lot of access to your data
depending on how the company is doing things.
And that's why it's always important to chase after
as close to zero knowledge as possible,
because why would you want to trust random people
behind companies with your information?
Or why would you trust a data breach
doesn't lead to something really sensitive coming up?
It's a good talking point, I think, that I've had a lot of luck with.
There's a semiconductor company named Analog Devices that disclosed a data breach.
They say their operations were unaffected, but if you want to learn more, check out the show notes.
We also have a small update to Fairlife, which I had no idea was a Coca-Cola company.
And they just have a small update here that they confirmed that data was stolen as part of that attack.
So you can learn more about that if you want to learn more in the show notes.
Australian energy provider Origin says a data breach exposed client data.
And so this impacted things like full names, physical addresses, date of births, and it's impacted quite a lot of people, 4.8 million.
And so if you have any sort of relationship with Origin, make sure to look into that story.
OnTrack has also started notifying customers of a data breach after a network hack.
This is a parcel delivery company.
And so if you were impacted by this, ideally, you got a quick notice about that.
Chick-fil-A also has come out with a few more details.
I believe we covered this last week.
So if any of you like eating chickens, they have a data breach that impacted more than 13,000 customers.
So it was a bit of a smaller scale breach here.
And they got it from a third party source, apparently.
And so if you do want to see if you were impacted, check out the show notes down in the description.
All right, now we're going to get into the threats.
And, you know, we're running a little bit short on time here, so I'll do my best.
But Patrick Brayer, who's been kind of the main politician who is helping lead this whole movement against chat control,
He just put out a quick blog.
I'm not going to talk too much about it
because it's quite similar to other things he shared.
And we even talked about it, I think, last week or the week before.
But it's just a quick blog post that is very well written
about how the true losers of Chat Control 1.0 coming back are children
and why he feels that way about it
and kind of the stats behind Chat Control
and why they overwhelmingly actually can sometimes harm children as well.
So if you want to read a little bit more about it,
definitely check out the show notes.
This next one is a quick update.
I'm still wrapping my head around it and how I feel about this one.
but Google has a privacy-preserving age verification system
that's coming to the Play Store,
and this relies on an API that ties to parents.
This doesn't require an ID.
It doesn't require selfie verification.
It's just connected to the Family Link app.
The idea is that parents will set age ranges
for their kids' managed accounts.
Of what I've seen, this is a slightly better system, right?
But again, the real root concern here, guys,
I have no doubt that we can solve the technology problem
of doing this in a privacy-respecting way.
I think that's possible.
I've seen the zero knowledge proofs.
It still hasn't really been done on a mass scale,
so I think it's not even there yet,
but let's just assume we figure that out.
I still have an issue with the idea
of changing what the internet looks like
depending on who you are.
I think that's really at the core now
of what I'm truly concerned about
because if we're starting to decide,
oh, for these people, the internet looks like this.
For these people, the internet looks like this.
And in this region, the internet is allowed to have this.
In this region, it's not.
We're going to start seeing a lot less
of a free open internet.
It's like if we have these different libraries spread around the city and, you know, one library doesn't allow people under this age to get in and this one doesn't allow people above this age to get in and all of them have different pieces of content.
We're going to start seeing curated content for specific groups of people and they might not get the full picture, right?
So those are my concerns.
It's a concern of censorship.
It's a concern of freedom of expression, freedom of information, all those things.
And I think that's really my long-term concern looking at these stories.
JetBrains has warned of a critical TeamCity remote code execution flaw.
And so if you want to learn about this, again, it affects TeamCity.
And if you use that, you should look into it to make sure that you're not impacted and
what you can do to prevent it.
This one's just interesting.
And so if you're more technical, you might like this.
But Mythos, Claude's, you know, crazy, you know, offensive cybersecurity model actually
found an issue with an algorithm candidate for post-quantum encryption.
But it killed the algorithm called Hawk.
like the quote here is basically with this paper hawk is dead um and so pretty interesting stuff
it's good that it was found and so um i do think genuinely that these ai models do have really good
potential to do really positive things and so um i'm trying to be optimistic about them um but i
know that that also comes with a lot of the negatives with them as well so um i know that
this kind of contradicts the earlier stories from earlier so um yeah i'm just doing my best to stay
optimistic, guys. The next story comes from
Misk, who are some security researchers,
especially in the Apple ecosystem
side of things, and they found a way to replace
trusted macOS app
executables, and they actually demoed this with Signal.
Let's say you download Signal onto your machine
or anything. Again, this isn't a
knock-on signal. This can impact any
executable with this
kind of flaw.
And so if you run a malicious app or script
on your Mac, and it'll replace them
with malicious versions. This doesn't
require your Mac's password or any special
approval, and it can happen entirely in the background. Accessing protected data still
requires your approval, but the macOS system prompts show the trusted app's name and icon,
making the requests appear to come from the real app. It's a lot more interesting than that if you
want to get into the technical details. Again, it's a very well-written blog that I do recommend
checking out, especially if you're more technical. But Apple has concluded that the
behavior does not constitute a security issue for the following reasons. One,
the proof of concept replaces the entire application bundle rather than modifying an existing
signed executable. The attack requires code execution as the current user and only affects
applications opened by that user. The replacement executable does not inherit the original application's
entitlements, and Apple considers convincing a user to approve these prompts to be a matter of
social engineering rather than a bypass of their security mechanisms, and Gatekeeper is designed
to evaluate downloaded applications before their first launch. So there's kind of an ongoing debate
of whether or not this is something that Apple should patch or not. Okay, everybody, and now we're
going to get into the open source updates starting with proton pass and this one is quite interesting
and it's an autofill improvement here so it can autofill on sites where it previously couldn't
including shopping platforms social media sites forums and banking websites and it just they
improved the way that they detect forms on the websites you're visiting what i really want to
know is if it's going to work with apple if you guys know there's like a very notorious thing where
logging into an iCloud account only works with Autofill and Safari.
So let me see if I can actually test it myself right now.
Oh my gosh, dude, guys, no way.
I'm literally on Apple's site.
I'm obviously not going to show you because I don't want to reveal my credentials.
It's in a different browser window.
But Autofill now works on iCloud.com.
So for any of you Apple users out there who have kind of caught that Apple doesn't really
agree with much Autofill, ProtonPass, I just confirmed, now works with iCloud.
They also have a liquid glass animations and some other updates there, which I think are
not the highlight changes, but pretty good stuff overall.
Tails 7.1 got a new shutdown procedure.
Tails is the anonymous operating system that is ephemeral, and it's a bit slower, but it
prevents data loss.
So the power off confirmation dialogue informs you an application needs to be closed or an
open document needs to be saved.
Even if you don't confirm, Tails will still shut down after 60 seconds, which is what my
first thought was.
Tails is theoretically used in emergency situations.
So how does that play along?
They replaced Gnome Videos with Celluloid,
which is a more modern and reliable video player.
It looks like they have some other just minor updates that go along with that.
Thunderbird hit version 153, which they're titling Meadow,
and it launches with a smoother setup,
Thundermail integration, and more.
Seems like they have some nice appearance updates.
They now work with native support from Microsoft Exchange email servers.
There's quite a few other changes.
So if you use Thundermail or Thunderbird,
I would definitely check this one out.
This is a quick signal boost that there's a new Firefox Nova UI with the return of compact mode.
I actually made a whole video on the main Techlore channel.
So if you're on YouTube, I'll leave a card for it.
Or if you're on the podcast, I'll leave it in the show notes.
But I did a whole first look at this new Nova UI in the nightly version.
And I kind of walked through what it looks like, what the differences are, and compare it to regular Firefox.
And I do want to remind people that most likely this is going to eventually be a downstream thing, right?
like Mullvad browser will eventually inherit some of this,
Tor browser, et cetera.
And so this is kind of the new direction for Firefox.
So I kind of detail what I like and don't like about it.
So I would check out that video
if you want to learn more about this.
Collabora Online,
which is an online collaboration document thing,
think like Microsoft Office,
but in the cloud and open source,
adds optional AI assistant
and smarter document comparison and review.
And so if you use Collabora,
definitely go check that out.
Now we also have Wine that hit version 11.14.
You can find a changelog down in the show notes.
And that everybody is going to wrap up
this week of surveillance.
A lot of interesting stories, a lot of AI stuff.
We had other interesting things outside of the AI stuff.
So thank you all for tagging along on this journey.
If this analysis helped you reclaim control,
you can become a Techlorian
by visiting a link in the show notes.
You'll gain access to our private signal group.
You'll get some other perks in our community.
And regardless, if you want a newsletter version of this,
like you just want something quick in your email inbox
that's maybe quicker to forward to your friends and family,
or honestly, it's just really good
for your friends and family
if you know they're not gonna listen to a whole podcast.
I do like a TLDR five-minute read of this podcast
on our website every single week that's a newsletter.
And it's free to access.
It's not spammy or anything.
So if you want that,
I would really recommend checking that out
and signing up down in the description.
If you haven't already too,
make sure to leave a rating.
I know Spotify, if you're listening on Spotify,
just click however many stars you like this podcast.
And if you're on Apple, same thing.
Just leave the rating.
It really helps a lot.
It helps for discovery and it helps me reach more and more people with this news.
And I want to thank you all for listening, being here this week,
taking your privacy and security and your digital freedom seriously for one other week.
And I'll see you in the next episode of Surveillance Support.
You're all awesome.
And I can't wait to be back next week.
See you soon.