This week's Surveillance Report covers the EU bringing back chat control, and there is
a lot to discuss there, so let's buckle in.
We also have a brutal stretch of Microsoft security and tracking news, the age verification
wave hitting both sides of the Atlantic, and the growing resistance to Phlox license plate
surveillance, plus a double-week defense bulletin.
Welcome everybody to the Techlore Surveillance Report, your essential weekly tech news delivering
deep analysis on the latest threats to security, privacy, and digital freedom, empowering you to
reclaim control and defend your rights. I might be wondering what happened last week. I have been in
the middle of a crazy move, which for whatever reason, everything takes three times as long
as it needs to, including even getting home internet. So I'm finally all locked in. So
everything should be back to normal, but I want to thank you all for your patience.
So this is a double week and I did try to consolidate as best I could to keep this
in a reasonable time frame. Without further ado, let's get into chat control. So this is an EU
specific thing, but don't get carried away thinking this doesn't impact the rest of the world. Again,
we see how these fights are globalized in the sense that something that happens in one country
inspires other countries to follow in their steps. We see this right now with age verification,
which we'll talk about later, but Australia passes a social media ban and now everybody
wants a social media ban. If you're new or you want a quick recap, chat control is this overall
of message scanning. It's supposed to try to keep children safe, prevent abuse. We've heard all
these arguments about these very serious issues, but the questionable ways of dealing with them.
Now, the one thing that is often confused is that there's chat control 1.0 and chat control
2.0. Now, between those two, we don't want either of them, but 1.0 to me is slightly less of a
concerned in 2.0, and I'll talk about why in a second. But this still is very bad news. Now,
we did coverage for this, and I do these hot style videos that I was putting out earlier this year.
And of course, while I'm going through a move, I watch all this happen as I'm sitting on my phone
just watching these things happen. I don't have a recording set up yet. And all of you who are
emailing me, I think we got a few emails from you guys asking, like, hey, where's the coverage for
this? So I have to apologize because it really sucked to be on the sidelines while all this was
going on. But this actually was temporarily held off not that long ago when we were doing coverage
for it earlier. But it was always kind of with an asterisk, right? I think even the thumbnail I used
for that video had an asterisk. And then a big point I made is that this is going to come back
at some point. But they really made it come back like that before anybody could really react very
well. There was a potential for it to be overruled, but it would have required a supermajority,
and that vote didn't come across as a supermajority. So this did end up actually getting
through. Now to actually answer what ChatControl 1.0 does, which is probably what you're wondering,
so Patrick Breyer breaks this down in his blog really well. So what's coming back is that he
specifically says U.S. tech companies. Now the reason he's specifying U.S. tech companies is
because there's a big movement right now, especially in Europe, to get away and have
digital sovereignty so that their own companies are handling their own data. We're seeing this big
wake-up call of, hey, maybe it's not the best idea to trust a government who doesn't maybe align with
our interests with all of our data because people now realize the power that that entails.
So Patrick is making a point here of saying, hey, yeah, this is enabling the U.S. tech companies
to start scanning private messages without a warrant or prior suspicion. They can just do it.
This affects direct messages on platforms like Instagram, Discord, Snapchat, Skype, and Xbox,
as well as emails via Google, Gmail, and Apple iCloud. Now, good news and why I believe chat
Control 2.0 would be worse in some capacity. I think both of them together are the worst package.
My understanding of Chat Control 2.0 is that it actually allows scanning of end-to-end encrypted
chats, meaning chats that theoretically only you and somebody else have access to because those
encryption keys belong to you too. And so scanning those messages requires some kind of encryption
backdoor, which is what Chat Control 2.0 pushes for. This is not that. This means that things like
WhatsApp, Signal, etc. are exempt from these scans. Additionally, European providers of messaging and
email services have never implemented chat control measures. And so there are some good news, I guess,
here, but it's not really good news, right? Like this is really just saying like this could have
been a lot worse. But I think this is a huge warning of like, hey, the things that are the
worst that haven't been touched yet could still be touched. And I think this is a big wake-up call
that we need to get our, yeah, we need to get our stuff together, right? You guys know the word I'm
trying to say there, but we got to get our act together. Now, Patrick breaks down why this
doesn't really work. They talked about how the abuse reports actually spam police. The actual
number is 48% of all incoming alerts are not criminally relevant in the first place. Crime
stats reveal that 40% of the resulting investigations actually target minors themselves.
And under the chat control system, an estimated 99% of reports generated by Meta consist of
previously known material, which generally does little to stop ongoing active abuse.
And of course, Patrick makes the point that people who are abused need their own privacy to escape these abusive situations.
And so he cites some actual case studies and individuals who have had to go through this and how they are against chat control and their reasons for doing so.
So I hope that I did a good job kind of covering what happened and maybe, you know, potentially what's next.
Important thing that Patrick continually tries to drive home is that Patrick sees this as a distraction from real child protection.
The more we're trying to just pass this needless scanning that hasn't even been shown to be helpful to victims of abuse, the less time we can actually dedicate to really protecting children.
So here's a direct quote from him.
As long as EU governments can use procedural loopholes to continually extend their comfortable status quo of voluntary indiscriminate mass scanning, they have zero incentive to engage with the parliament's targeted, legally sound, and far more effective child protection strategy.
And I think that's really the core point that I'm always trying to make in our content, but really everybody else, even if they don't say it directly.
The reason why people in the digital rights space are against this mass scanning and mass surveillance is because they don't care about keeping kids safe.
It's just they question whether or not these strategies are actually doing what they intend to do.
And it's not just politicians coming forward and saying, oh, but think of the kids while we, you know, push all this stuff that probably isn't going to help anyone to try to get those things passed and convince people that it's good.
We're seeing the same thing right now as social media bans and trying to say like, oh, yeah, we're going to solve this and think of the kids and upload your ID to every platform now while we don't do anything to actually solve the real problems on these platforms.
So it's kind of a universal thing that we see politicians really utilize, which is unfortunate.
Now, I did miss doing hot coverage for this as it was happening.
So I do want to apologize again.
I know a lot of you reached out.
But one thing I am going to do to at least try to make it up, but it's something I want to do anyway, is put together some kind of guide for all of you in Europe.
This was actually something requested in the comment sections by a few of you as well of like, hey, what can I do about this?
Like, how do I protect myself from the scanning so I can put together some resources and put out a guide for that in the next several days.
So keep an eye out for that on the main Techlore YouTube channel.
And that should be live soon.
All right.
Coming later, we have the flock resistance.
We have the age verification wave, which is hitting everywhere.
But I have a ton.
You guys can see this on the video right now.
A ton of Microsoft stories.
Microsoft made a lot of rounds this week.
So good and bad news.
And we're going to start with some bad and then kind of bounce back and forth between good and bad news.
I think it's mostly bad, actually.
So I think there's like one or two good stories in there.
But the first story here is Microsoft's secure boot has been broken for a decade and no one noticed until now.
Before I even get into the story, I think a lot of people who are really into the security world would know that secure boot is maybe something good.
but it's never been the most robust tool.
It should never be like your main protection security net on your system.
But still, this is something that should reliably be trying to prevent malware
from being persistent on your computer.
Now, this is from the security firm ESET,
and they identified 11 firmware images, at least one from 2013,
that were known to be defective but remain signed by the software company anyway.
These are known as shims, which were invented to extend secure boot
to Linux devices and utility software.
Using a technique simple enough to be performed by novice hackers,
these old forgotten shims can be used to completely circumvent secure boot protection,
which is embedded into the UEFI of the device's motherboard.
The overall idea here that the researchers claim is that Microsoft didn't do a good job
of actually overseeing that the things that they were signing
were actually trustworthy pieces of software that don't have vulnerabilities in them.
The big gotcha for this, and actually I was close to making this the highlight story,
because think about it, like this actually impacts Linux users as well,
because it's not just a Windows concern, because a lot of people using Linux
are still using Secure Boot.
Because again, this is upstream of your operating system.
And so especially if you're dual booting
or if your motherboard requires Secure Boot
and you're using Secure Boot,
either way, it's upstream of your operating system.
And so if somebody was able to exploit it
and pretty much implement one of these 11 installations
that have vulnerabilities inside of them,
Microsoft would have allowed that to happen.
Now, how do you know if you're safe from this?
So a couple things here.
So if you're just using a basic Windows computer,
the secured core PCs in their default state
should actually be immune to this problem.
You can read more about why that is.
It's a bit of a complicated response,
but if you want to learn more,
you can always check out the show notes
to dig into the why if you want to learn more there.
And if you are a Windows user
who has installed Windows Microsoft June update batch,
you are no longer vulnerable to this.
Linux users should check the Linux vendor firmware service
or consult their distributor.
Revocation statuses are available
using the UEFI DBX audit script as well
if you want to do that manually.
I think the scariest thing about this
is that this has technically been possible
for over a decade now.
So hopefully nobody else knew about this
and was just randomly using it in the wild.
I didn't see anything indicated here
that hinted at whether or not they knew
if this was abused in the wild.
So I hope the answer was nobody else knew.
But I guess we might never find out.
Now let's move on.
There was a patch for Windows Defender Zero Day
that could allow attackers to fill your hard disk.
So this is another Nightmare Eclipse story.
So I take two weeks off, but some things go unchanged,
including Nightmare Eclipse,
who has still been causing problems.
And so that's from July 9th.
Just make sure you're up to date.
If you want to read more about that saga,
it's been going on for a while now,
but you can check it out in the description.
TLDR, if you're using Windows Defender
and or Windows for whatever reason,
make sure to get yourself updated.
This next story I know isn't a massive wake-up call
to anybody who consistently listens to this podcast,
but it's an important thing to keep in mind
as a reminder to yourself.
It also gives us actionable data.
This is really important
because people talk about the Windows concerns
privacy. And there are a lot of things we can measure. We can tell you how much telemetry is
being collected from network analysis and all this stuff. And there's tons of really interesting
reports on this. And yes, Windows is not privacy respecting, but we have to remember that's a very
vague way of saying something. What does to a regular person, hey, Windows is privacy invasive.
What does that mean to them? And I think that these very distinct stories can actually help us
see what that means. So there was a teenager who was a hacker who did bad things. You can read more
about what they did in the show notes.
But the arrest actually revealed something called a GDID.
It's a unique identifier that's tied
to every single Microsoft Windows installation.
And it's because of that GDID
that they were actually able to track this guy down.
Surveillance is such a big word.
And I think Microsoft actually probably does
far more egregious things in terms of privacy issues
on their operating system
and the amount of data they collect about you
and things like recall, et cetera.
So there's actually a lot of things that I would classify as like surveillance status technology.
This to me is a milder version of that.
It is an identifier that is tied to your operating system that I think most people would assume Microsoft would have some way of getting anyway.
So I don't think this is as maybe riveting as the PCMag team seems to portray it as.
But it is still something that we need to remember.
And even at the end, they say this probably isn't a Microsoft-specific issue.
But ultimately, if you really want full transparency, and it's weird because they pose this as if you want to be fully anonymous, you have to use Linux, FreeBSD, that's what it says in the article. But I don't think, you know, somebody, and actually that's a three-buddy problem podcast that said that. You don't need to want to be anonymous to use Linux. I think if you just want an operating system that you can simply answer the question, hey, is there a unique identifier tracked to me? I just want to know. You have to use Linux to do that, right? Because these companies aren't very transparent about what they're actually collecting about you, which is the whole problem.
is you don't know what you're consenting to.
So I actually am fine if somebody wants to use Microsoft,
if they want to use macOS, if they want to use Linux,
it's all fine.
I just think that you as a consumer
should fully know and understand
what you're getting yourself into
so that you know whether or not you even consent to it.
Okay, now we have the, I believe, the one good news.
I guess the next article, and you'll remember this,
the next article could be interpreted as good news
depending on who you are,
but Microsoft has added another year
to Windows 10 extended update program.
So the drama around this, I'm calling it drama, it's light drama, it's not actually that serious,
but Microsoft has been a little bit iffy on whether or not they're going to continue
extending security updates for Windows 10.
And normally this makes sense, you know, at a certain point,
a company needs to let go of their old operating systems and
maybe put more of their attention to the newer ones.
And that's just a natural thing that happens with older software.
And Windows 10 is quite old at this point in time.
It's crazy how time flies.
But why people were upset about this is that they were forcing a lot of people to move to Windows 11,
but their computers were still fully functioning.
So Microsoft had far steeper hardware requirements for Windows 11 devices,
and it left all of these millions of devices still running Windows 10s
that weren't capable of going to Windows 11 that were no longer getting security updates,
making them practically dead weight for anybody who values just basic digital safety.
So Microsoft put out this program.
They originally were going to charge money for it.
If you are still stuck on Windows 10 for whatever reason, they are actually extending this for another year.
If you're in the EU, you get these updates for free.
So go pro user regulations.
That's awesome.
But in other regions, you have to sign in with a Microsoft account and sync your system settings to be eligible for free updates.
Otherwise, it costs $30 or don't forget 1000 Microsoft rewards points.
I forgot that's still a thing.
So you can join the program.
Once you're in the program, the ESU license works on up to 10 devices.
but they do stress this is for personal use, not business use,
which you do have to pay for if you're in a business.
So I actually think that from where this originally started
when we were doing coverage for this when it happened,
which is Microsoft is like, hey, we're going to drop it completely.
You're screwed.
To, hey, we're going to make you pay, which still isn't a good situation.
To, hey, actually, yeah, we've kind of like overall made this a lot easier to access.
So I think this has really moved in the right direction.
But still, keep in mind, there are some genuine security enhancements in Windows 11
that Windows 10 doesn't have.
So I'd still overall recommend that if you are leaning into this to get security updates,
that's good.
But start thinking about what your next device looks like,
or if there's some way to get Windows 11 on that machine anyway.
And the last story, which I will let you all decide if this is good or bad news.
I assume most of you will think this is good news.
But data has shown that Windows dropped their overall share below 60% for the first time in years,
whereas Linux reached 4.39, which is one of the strongest recent showings.
Now, these are calculated based on web traffic.
They're not actually exact.
There's no real way to track this deep down and actually get an actual number.
But typically, this is probably accurate as a pattern over time.
And to see Windows drop and Linux go up, I think is extremely exciting.
And I think reflects overall the one that's valuing people and what people really want.
I don't think people want this crap that Microsoft has been pushing the last few years
of just shoving AI into every single thing.
And that's why Microsoft is literally backing off their AI stuff.
They're removing it from different things or at least trying to rebrand it so it's not as obvious.
And I just saw earlier today, I didn't put this in the show notes, but they are now trying to
redo their search in Windows that has less ads and it's more useful. And it's like, wow, imagine
that a search that actually is designed to be useful and search for things on my computer.
Wow, that might actually get me to enjoy the operating system a bit more. So I think Microsoft
might be getting their asses handed to them and they're starting to realize, hey, we got to
actually make a user-friendly OS. So I hope it continues that way.
All right, coming soon, we have the big flock movement that's happening and the flock resistance.
But before we get there, we have a few updates when it comes to overall age verification,
social media limits, all this kind of stuff. Not so long ago, Texas put forward an age
verification law, which is quite unique in that it didn't target platforms. It didn't target
operating systems, it actually targeted app stores, specifically mobile app stores like the Apple App
Store and the Google Play Store, so that anybody had to essentially verify their age just to start
downloading apps. That means if you just get a new phone and you want to download a calculator app,
you have to upload your ID. Unfortunately, the Supreme Court has actually sided with Texas in
light of this because there was an ongoing lawsuit. The big tech companies sued and tried to undo this
and say, hey, this isn't fair.
We shouldn't have to do this.
But the Supreme Court sided with Texas.
Now, what this does, and I want to be very clear here,
this allows them to uphold the law and actually implement the law
because the law is theoretically, I think June is when it should have passed.
But it allows them to essentially move forward,
even though the lawsuit hasn't finished yet.
And I do want to be a bit specific here because I read over this a few times
and I'm still a bit lost because they didn't specify this super directly.
But it's unclear if they even took the case
Because at the very bottom of this article, it says by declining to take up the emergency appeal from the computer and student groups, the Supreme Court has left the Fifth Circuit's decision in place.
So I'm unsure if the Supreme Court actually sided with Texas and actually made an active decision.
And then the computer and student groups did the appeal, which I think is actually run by the big tech companies.
It's synonymous with them.
And then they just didn't hear it.
So therefore, the law goes anyway.
Or I'm not sure of the details on what happened behind the scenes.
This article didn't do a good job of breaking that down.
But the overall takeaway is that in Texas, they can still uphold this and the case is still ongoing.
Now, that's not all.
And this is a very U.S. heavy week because the House voted on the Kids Act last week, something else that I would have made a hot video about.
And I was unable to, which is a bit sad.
So the package combines a revised version of the Kids Online Safety Act, which was COSA, CASA, with several other Internet bills, study bills and reporting requirements and different regulations.
The problem with this, as good and noble as it might sound, is that it actually pressures
online services to impose different age-gating schemes using different standards.
The EFF is strongly opposed to this.
This article actually comes from the EFF, and they clear the field on why they feel that way.
The TLDR is things we talk about.
There's no way to reliably verify age in a privacy-respecting manner that also keeps
children safe along the way.
And we haven't really seen the evidence that these things work.
In fact, we've actually already seen breaches of age verification providers, and that's exactly what they say here.
There's not too much more beyond that right now.
It's a very short article that the EFF put forward there, but I do recommend checking it out.
And if you are in the U.S. right now, you need to be contacting your politicians.
That's like the number one thing that you have in terms of direct kind of action that you can take.
I know it doesn't seem like much, but when hundreds or thousands of people contact the same rep about a problem,
that makes them pay attention to it and think twice about how they're going to vote for it.
It really does matter.
So make sure to get involved.
And if you're not going to do anything about it directly,
then try to support the EFF or another organization that's doing the fight.
This whole episode is a good example of people who think they get to decide where your data goes.
Cameras who log your plates on the way to work.
Governments that want to scan your messages.
So there's something almost funny about it.
The one map of your life that you'd actually want every city you've walked through,
every trip, every road trip, restaurants that you love, places you went to with your family,
get actually turned into the creepiest things that you can own purely because it's normally handled by big tech companies like Google.
But it doesn't need to be that way.
If you want to see a map of places you go and restaurants you enjoy, parks that you went to,
you can actually own that map of everywhere you go, every park you love,
every place that you've taken a picture of a bird, all with Dava Itch.
They are an open source, optionally self-hosted location history app.
They're basically Google Timeline, except the map belongs to you.
If you've been using Google Timeline or someone in your life has been using it, it is easy to swap.
They have a Google data import, and then you just have your same data accessible, but you actually control it.
And that's really what everything is about.
You should be able to collect your location history and do it in a way where you actually control the data.
And nobody's selling it or feeding it into a police database.
Take that, flock.
Now, there still is a layer of trust when you use Dava Itch, but that's why they also allow you to self-host it if you want to go completely trustless.
The difference that really matters to me is that they are a privacy-first organization
that's open source, and their entire premise is that your data is safe and belongs to you.
You can self-host them for free or grab the hosted version down at davahitch.app,
that's D-A-W-A-R-I-C-H,.app, slash tec hlor.
And the code Techlore gets you 20% off your first year.
All of that will be in the show notes.
Whether you're an athlete saving your favorite runs, tracking office days for taxes,
or you want a year of your life, or a map that nobody else owns,
It's worth a look.
And now, back to the show.
If you don't know, Flock is a very creepy company.
It's been making a lot of headlines because they are a license plate tracking company that's being served to police.
And they all go and do this without warrants.
And it's just a creepy surveillance dragnet that just catches everybody in the mix.
And they even tried partnering with Ring in the Super Bowl.
And it didn't go well for them.
So people are kind of waking up and they've become kind of the face right now.
It's always changing who the face is.
But right now, the face of like the commercial corporate surveillance ship that keeps moving
is Flock.
And the LAPD has let their contract with Flock expire, citing serious concerns over civil
liberties and privacy.
I don't know if that's actually how LAPD really feels about it.
But ultimately, they probably had enough public pressure to say we can't renew this.
And that is excellent news.
Good job, LA, and good job, LAPD, for making that call.
And on that note, there's actually going to be a deflock week of action that I wanted to draw some attention to.
So if you want to learn more about this and get involved, that's also going to be found in the show notes.
It's noalprs.com.
It's the National Week of Action Against ALPRs, and that's August 16th through 22nd.
And you can actually see all the participating cities all around the U.S.
There's over 100 of them.
So if you want to get active and meet other like-minded people, this is a great opportunity
not to show what you're passionate about and show that you don't want this stuff in your
local towns, but connect with people.
This is really important stuff.
It's far more impactful than just connecting online.
I really think those in-person connections are worth 10 times more than online connections,
and you will actually feel kind of that camaraderie when you're around other people who think
like you.
right and now we're going to get into the defense bulletin again there are three subsections here
the first one is the data breaches which is what it sounds like then there's the threats which are
things that you should know about to keep yourself safe and the people around you and then we have
the open source updates so starting with the data breaches i'm going to try to keep this really brief
this week guys just because of time requirements and i just want to get this out so we can get back
on schedule. But the telco giant KDDI says a data breach affected over 12 million people. That's a
Japanese telecommunications giant. So if you have any kind of relationship with this company,
check out the show notes. And that's going to be the advice for all of these stories. If you want
to learn more, check out the show notes. It has all the original sources there. There's also been
another massive data breach exposed that had millions of driver's license numbers. And this
was from the U.S. insurance provider Assurance America. And they have confirmed that it impacted
7 million people. And you may or may not know you're involved with this company. So it's worth
looking into this to see what to do and if you were involved. IT services giant Accenture has
confirmed a breach after hacker offers stolen data for sale. And so that is that data breach there.
We also have Mount Royal University who has confirmed a breach as hackers claim attack. So
if you have any kind of relationship or you previously had a relationship with MRU,
the university. Make sure to look into this. I don't see a cited number of students yet,
but this is probably going to have more information as more comes to light.
My gosh, I feel like this is a common German brand. Yeah, German discount supermarket.
Little Lytle has notified customers that they had a online shop breach after a service provider
hack. They should have already notified people about this, but if you want to learn more or you
have an ongoing relationship with them, you should dig into it to see if it impacts you. All right,
Health tech firm Zolis?
Actually, it's funny because the title here says X-O-L-I-S, but the actual article and
the image say X-S-O-L-I-S.
So I'm not sure which it is.
I feel like it's X-S-O-L-I-S and their headline is wrong.
But they suffered a data breach impacting 1.4 million people.
This is a healthcare technology company.
And so if you have, again, any relationship with them, check it out.
And that one specifically might be more downstream.
So you might not know you do because it's used in hospitals, health insurers, etc.
So make sure to look into this one.
We also have the DHS that's confirmed that hackers breached the H-S-I-N info sharing platform.
That is the Homeland Security Information Network, which is a sensitive information sharing platform used by federal, state, local and private sector partners.
So if you want to learn more, again, show notes.
Okay, similarly, I'm trying to keep the threats a bit more compact this week than normal, but I'll try to highlight main takeaways when I can here.
So Google's actually paid $250,000 for a Linux vulnerability that allowed guest VM escapes.
So if you had a virtual machine, it would actually escape the virtual machine and infect your main computer, which is a pretty scary thing.
Both flaws have received patches in the Linux kernel.
So if you're a Linux user, you just check your distribution to make sure the fixes have populated.
And if you want to learn exactly what the fixes are and how this happened, I would check it out in the show notes.
Now, there was a hidden backdoor Intenda, T-E-N-D-A, router firmware, which grants administrative access.
That one is still ongoing, I believe.
So I really recommend following this if you have this router.
It's a pretty spooky attack.
This is a really good story.
There was a European Parliament member that was investigating Pegasus spyware, and it actually ended up on one of their phones.
If you don't know what Pegasus is, it is the creepiest form of malware you could possibly imagine, which is a government doesn't like you.
So you wake up and you have malware on your phone.
It's zero click.
It just kind of works and it just allows instant hacking.
It's crazy.
It's like what you see in a movie.
Now, if you're on an iPhone, the main way to prevent something like this is lockdown mode.
Apple does have a feature designed specifically to target these attacks.
And Apple still hasn't found a single case where someone was actually able to bypass lockdown mode yet.
This doesn't mean it's impossible, but they haven't seen it yet, which is really impressive.
So I do recommend checking out the story.
It's quite interesting.
and there's some good nuggets here as well
for those of you who want to learn more
about these government-grade spyware.
Now, on the topic of Apple,
there was a macOS piece of malware
which is called Pamstealer
and it goes into this,
the execution chain, how it works.
I do recommend reading into it.
We just don't have the time today for it
but it is a very interesting one.
There's also a Crashstealer malware
that's posing as Apple's crash reporting tool
and it is targeting password managers
and crypto wallet extensions
and it's actually a notarized malware.
So lots of fun stuff here.
So if you do care and want to see how these like macOS exploits are going,
again, normally I would dig into these a little bit deeper,
but this week I am keeping it more brief.
This is another PSA, but there are 300 GitHub repos
that pose as legit software to push malware.
It's pretty much impersonating real services you might try to find on GitHub,
but it's not actually the real thing and it's instead malware.
So just always make sure that you're going to the right repo.
This isn't some kind of GitHub specific issue.
It's just a universal thing.
Anytime you're installing software,
Make sure you're getting it from the actual trusted provider.
I do like to, it's one of the reasons actually I don't like people who don't have their own dedicated websites and they just have GitHub be their website.
I like having a dedicated website where someone is like, I have planted my flag on the internet.
Here is how you download my software in the most trustworthy manner possible.
Because if the person doesn't do that, it opens up the opportunity for scammers, hackers, etc. to take that spot for them.
Now, LastPass, Bitwarden users were also targeted with fake security alerts.
And so if you want to see what this ongoing phishing campaign looks like,
it's nothing too crazy.
It's just a malicious email you get that, you know, tries to get you to do something.
It's all phishing.
It's nothing new, but it is worth flagging,
because I know a lot of you are Bitwarden users especially,
that this is an ongoing thing.
So just be on the lookout for it.
All right, everybody.
And now we are in the open source news.
And this is one of my favorite things.
And it's an easy way for me to also promote our signal group.
We've had signal polls for a while now, and I even use them in our signal group sometimes.
We have about 150 people.
It's for our tech laureens.
And so if you want to support us and gain access to a little private community just for other people who like our content, you can do that.
But now they've extended the capability for individual chats, too.
And so if you want to send something to an indecisive friend or recapture the magic of passing a note to your crush, you can send polls in an individual chat now as well.
Now, Graphene OS has updated their secure exec spawning feature with a new implementation.
They're also adding a per app toggle to enhance application compatibility, which is really good
because if an app didn't agree with it or somebody doesn't want it for a specific app,
now you can turn it off, which is pretty awesome.
There's also a few bugs that they fix.
And so if you want to update to the latest version, that's probably a good move.
CalyxOS is also back with version 7.2.2, bringing the Shift Phone 8 support,
which I have one in my closet that I still need to review.
Now, a few things to flag here.
It has that new phone, which is really exciting.
But if you are on an older version of Kallax OS,
which I kind of hope you aren't on
because they haven't had security updates in a long time.
But if you are on those older versions,
you do need a clean install to go to version 7.2.2.
Once you're updated, then you go back to normal over-the-air updates
and everything's kind of back to normal.
One really cool thing is they have this new signing thing
and they actually really detail it on their blog
if you want to learn more.
But it's like a hardware security module-based
open source signing thing that is actually really awesome.
So it's cool to see them back.
I'm really excited to see them back.
I was a little concerned when they just randomly dropped off to face of the earth,
kind of, with their announcement of like,
yeah, we're just stopping and coming back at some point in time.
But I'm glad at some point in time actually happened,
and it's cool to see another ROM option for people.
We got a lot of ROM updates,
and so Lineage OS has introduced web flashing tools,
which is really exciting.
They have revamped their stats page.
They have Android 17 plans that they've announced,
and quite a bit more.
They've also migrated from GitLab to GitHub.
They got a dark mode in their documentation.
and they've also deployed security patches along some other updates.
They've also announced that Lineage OS 24 development is underway
based on that latest version of Android.
So there's something for all custom ROM users.
And even PostMarket OS has introduced KDE Plasma 6.7,
better USB gadget handling, and WayDroid updates.
So if you use any kind of non-Apple or non-stock Android operating system,
you probably got some kind of update this week.
Now, Linux Mint has planned full Wayland support and security updates,
And that will be in the next release.
And they're going to be supporting Wayland in Cinnamon, which is pretty exciting.
We also have Brave that now has working containers just like Firefox for tab isolation.
It's quite funny because not that long ago, the main reason and the main debate that I
saw between Brave and Firefox is that Brave uses profiles and Firefox uses containers.
And it's kind of this preference of like, do you want to have pretty much different versions
of the same complete browser, which is what profiles are?
Or do you want the same browser, but just like containers for specific sites?
And this very different way of using these web browsers
kind of separated two different people.
But recently, Firefox introduced at least the concept of profiles in Firefox,
where I think, I don't know if they released it yet,
but at least they announced they're intending to do it.
And now Brave is working on containers.
And so now I guess the debate's going to be gone soon
because you can do either on either browser.
The really cool underrated thing about this is, and it says this here too,
Brave's release marks the first time containers are available in a Chromium-based browser.
I actually haven't used this yet, and I might do a live demo of this if it's interesting enough.
So I will keep an eye out on our YouTube channel.
I might demo it if you guys want to see how it works.
Image, which is the open source self-hosted photo and video management solution by Fudo, has hit version 3.0, and it adds non-destructive editing and OCR on mobile and some other interesting things.
So if you use Image, definitely check that out.
Organic Maps, who I've interviewed on Techlore Talks, if you want to learn more about them.
It's our sister podcast where I just interview founders, experts, et cetera, from different things in the space.
but they've added satellite imagery, public transport routing, alternate routes, and more,
which is really exciting. And I know a lot of people literally in the comments of that interview,
which was quite recent, asked for those things specifically. So that's pretty big news.
ProtonVPN has officially launched a Snap package for Linux. I think maybe some of you are going to
be really excited about this, but many of you probably don't use Snap. But either way, I think
it's one extra option, which is pretty cool. And yes, they already have a flat pack. So this is
really just in conjunction. I do want to play around with this a bit more before I really add
too much commentary, but Lumo is Proton's AI chatbot, and they did introduce Lumo 2.0,
and they've completely redefined it, and they say it's a lot smarter, and they bring more personality.
So if you are interested in AI chats, but with more privacy, I think Lumo is actually a great
way to do it and kind of dip your toes to see if you find any value in it. And now it's going to
be a bit smarter and they kind of break down the new design, how it works. So if you want to learn
more, check out the show notes there. And then Proton Sheets also got an update with custom
formats, drift detection, and some bug fixes as well. Now, this is an update for those of you who
use the DuckDuckGo browser, but it now blocks YouTube video ads. So it's going to be pretty
similar to what Brave provides maybe. But if you use DuckDuckGo's ecosystem for one reason or
another, you now get to block YouTube ads too, which is pretty awesome. This one I'm also really
excited about. So Proton has always, not always, but for a long time now, has had an easy way to
migrate your data from Gmail. And Tuta has always lacked this. And it's been one of the main reasons
when I've consulted with individuals, when they ask me Tuta or Proton, I say, well, do you want to
migrate your emails? Because if the answer is yes, Proton is kind of your only option if you want an
encrypted provider. But now, Tuta has a one-click migration that is now in closed beta. So it's
closed beta. They have not given me access to this one, so I don't have closed access right now.
But I'm sure when I get my hands on it, I'm at least going to try to play with it. I don't have
a Google account with Gmail to play around with, actually. So I don't know if I can even test this.
But either way, I know a lot of people in your life do. And now you can get another email provider
option as well to do an easy migration. All right, this is the one that I know. You know,
you guys follow this podcast every week for the best news. Sometimes it's every other week because
I'm moving or whatever's going on. But, you know, this is the news you guys came for. And it's that
Hannah Montana Linux has been revived with a modernized stack and still a lot of pink. This is
one of those more humorous meme-ish style Linux distributions, but apparently they have completely
revived it. So if you are interested, I guess, check it out. All right, this next one is, I guess,
open source adjacent because WhatsApp is not open source. But I do know a lot of you, even those of
who use Signal still have to use WhatsApp for some of your contacts. Now WhatsApp has rolled out
usernames, so you can hide your phone number from contacts. It's going to be very similar from what
Signal does. In fact, Signal did it first, and it's kind of why I put it in the open source section
because the open source software led the way on this. But now I'm guessing it's quite similar. You
still need a phone number to sign up for your WhatsApp account, kind of like Signal, but you can
reserve a username, and that way you can just share a username with people without needing to share
your phone number. So I recommend a lot of you probably implement that unless you have a good
reason to use your phone number. Tails hit version 7.9.1. That's the anonymous-based operating system.
They've updated just basic things there. And also we got Kali Linux, the pen testing operating system
that hit 2026.2 with nine new tools and some NetHunter updates. So if you use any of those
operating systems, check out the show notes. All right, everybody, and that concludes the week's
surveillance report. If this analysis helped you reclaim control, you can become a Techlorian by
visiting the link in the show notes and or just follow the newsletter for this podcast. I also am
publishing a written version of this, which is like the quick five minute read that you get in
your email inbox each Wednesday. It's completely free to join and it's not spammed or anything.
It's just like a written accompanying guide to this if you can't listen to the full audio for
whatever reason. No matter who you are, I also really encourage you all to leave a rating,
share this episode with people you know. It keeps other people in your life stay safe and maybe get
them interested in these discussions as well. And it also helps us grow this podcast so we can reach
more and more people and keep this going forever and keep it super sustainable as time goes on.
Thank you all for listening and I'll see you in the next episode of Surveillance.