Software engineer, cyclist, Formula E, Extreme E, & F1 fan, Space enthusiast, EV owner, 3D printing hobbyist, Type 1 fun seeker, YIMBY at heart
Arcadia, CA
Joined January 2007
- Tweets48.1K
- Following115
- Followers667
- Likes8.5K
Alex Hung 🤔 retweeted
I feel nasty even entertaining the idea, but if those people got everything they wanted and they successfully destroyed SpaceX (which is one of the most transparently motivated fantasies I've ever heard of), they would be remembered as some of the greatest criminals in history.
Alex Hung 🤔 retweeted
I've uncovered why LADWP water rates are skyrocketing.
LADWP's supplier said water conservation was too successful, leading water use/revenue to collapse— justifying a 40% rate hike.
They asked us to save water, so we did. But we saved too much, so they're spiking our rates.
An independent, non-city-affiliated audit of Los Angeles Department of Water and Power rates has been ordered by Mayor Karen Bass, her office says. ktla.com/news/local-news/ind…
Alex Hung 🤔 retweeted
SpaceX will never reach orbit.
9 engines = explosion
Dragon won't work
Supersonic retropropulsion is impossible
You can't land a booster vertically
Starliner will easily beat Crew Dragon
MCT/ITS is a pipe dream
27 engines = explosion
Starlink will never work
Starship is a joke
Alex Hung 🤔 retweeted
the spelling CAMERASENOR_ON is not a typo, there’s a small spanish guy in your tv watching you
Alex Hung 🤔 retweeted
The apps that are supposed to protect you are the best attack vectors. We pointed our agents at Microsoft Authenticator:
We discovered any Android app with zero permissions could say “I’m Teams” and capture your tokens. Mail, files, calendar.
Huge find by @ofekdavidlevin
We got Microsoft Authenticator to hand over account tokens to a fake Teams app.
The app needed zero Android permissions. It just claimed to be Teams, and Authenticator never checked who was actually asking.
The result: full delegated access to mailbox, files, and calendar through Microsoft Graph.
Full write-up by @ofekdavidlevin with code and PoC: enclave.ai/blog/authmask-we-…
Readers added context they thought people might want to know
Microsoft patched this (CVE-2026-80097) in Authenticator v6.2606.4246+. It requires a malicious app already on the device. No exploitation reported at advisory time. Update via Google Play.
enclave.ai/blog/authmask-…
msrc.microsoft.com/update-guide/v…
Alex Hung 🤔 retweeted
So, some people reckon SpaceX should be Nationalized...
Let's consider the scenario and most likely outcome/s for this disaster-prone idea:
— SpaceX is not a private company anymore,
— $2 Trillion plus (for now) will have to be paid to shareholders, or it will be the single biggest Class Action Lawsuit in human history,
— Govt bureaucracy will infect the operations,
— Innovation will come to a halt,
— Cost to orbit will again go sky-high,
— It will become another Taxpayer's money pit,
— CHINA WILL WIN THE SPACE RACE
— Bye bye humanity becoming a space-faring civilization
We can literally go on and on...
This is one of the dumbest things I’ve read this year, for a large number of reasons.
First almost no one wanted to help @elonmusk build it. Then they laughed when he did and predicted failure. This was probable but on the verge they succeeded. Space Exploration Technologies Corp. @SpaceX is now saving the government billions and expanding humanity to be a greater civilization.
Governments and the usual red tape and corruption that comes with them, have no business controlling it more than current regulations do.
Screw this piece!
Alex Hung 🤔 retweeted
In a somewhat normal world we’d be hauling the CEOs of major TV companies in front of Congress to ask why they’ve built this shit. The answer can easily be Five Eyes told them to, but we can cross that bridge later.
Ok, I just checked this, and its literally running a freaking TensorFlow Lite model on 960×540 images with INT8 quantization every couple of seconds in an attempt to figure out what game you are playing.
It's literally called "alex.tflite" and its literally AlexNet and seems to follow torchvision.models.alexnet. As far as I can tell this does some strange nearest neighbor feature comparisons against a DB and literally doesn't work 99% of the time, you love to see your CPU get wasted every other second by this thing though. It also just seems to dump its results into the void because the consent gate comes later.
Anyways, here's the tf model graph and some dumped captures.
Alex Hung 🤔 retweeted
ACR off via your preferences menu on samsung TVs should not be assumed to actually disable ACR telemetry.
i’ve found several instances where the checks (whether deliberate or not) are either incorrectly implemented or not checked at all.
full report coming.
for journalists: it’s great you’re reporting on this but i’d ask you to send me a dm requesting access to the full report so you’re not making inferences from my decompilation session that isn’t supported by evidence.
If you've ever wondered why smart TVs are so cheap, this is why.
@log4j rooted his Samsung and found an always-on hot mic, automatic content recognition, geolocation, network mapping, ad targeting and user profiling, shared with Samsung's "400 partners".
A lot of it can be blocked in <15 min, wrote a basic guide below.
What your TV is doing
The main culprit is ACR (automatic content recognition). Your TV screenshots what's on screen, fingerprints it, and sends it home to build your ad profile. Samsung does it every 500ms, LG every 10ms [1].
What is insane: it happens on connected devices too.
Plug in your laptop, your console, your work machine, and your TV can fingerprint that via HDMI [1].
He also found that if your Samsung doesn't have a mic, it'll look for one from a connected soundbar or bluetooth device.
xitter.cf/log4j/status/211376224…
It's on by default, and you likely agreed to it on the setup screen you clicked through in 10 seconds.
Step 1: Turn off ACR
Samsung: Terms & Privacy → Viewing Information Services
LG: Live Plus
Vizio: Viewing Data
Roku: "Use info from TV inputs"
Sony/Google TV: Samba Interactive TV
Menus vary by model, but those are the names to look for. While you're in there, opt out of interest-based ads, reset your advertising ID, decline every optional privacy agreement, turn off voice recognition, and delete apps you never open.
Step 2: Give smart devices their own network
Put the TV, cameras, speakers and vacuum on your router's guest/IoT network. The logic is simple: these devices rarely get patched. If one gets compromised (getting drastically more frequent with AI), it shouldn't be able to see your other devices or home network.
Step 3: Block trackers for the whole house with DNS-level filtering
NextDNS (cloud-based) is easy and has a solid free plan. Pi-hole is a little bit more work if you prefer self hosting. For simplicity we'll focus on the former.
1. Sign up at nextdns.io (free tier is plenty)
2. Privacy tab: add a blocklist (OISD is a good bet) and turn on Native Tracking Protection for Samsung, LG, Roku, Amazon (see attached image)
3. Setup tab: copy your endpoint
4. Paste it into your router's DNS settings as DNS-over-HTTPS/TLS (or use the IPs + "Link IP" if your router only does plain DNS)
5. Bonus: block outbound port 53 except to your router. Some devices hardcode their own DNS to get around you
Then open the NextDNS logs and watch how often your TV phones home. It's eye-opening. If an app or update breaks, find the domain in the logs and allowlist it.
Why they do this
TV prices are down 97% since 2000 [2]. Most of that is better manufacturing and brutal competition. But once margins on the hardware hit zero, the cost moved to you.
In Q3 2024, Vizio lost $6.7M selling TVs and made $115.8M in gross profit from ads and viewing data [3]. They've said on earnings calls that they keep TV prices low to grow the audience they sell to advertisers. Walmart bought them in 2024.
This isn't a conspiracy theory either. Vizio paid $2.2M to the FTC in 2017 for tracking 11 million TVs without consent. Last December, Texas sued Samsung, LG, Sony, Hisense and TCL over ACR. Samsung and LG have since agreed to stop collecting that data without explicit consent [4].
TL;DR
1. ACR off
2. Ads + voice off
3. Smart devices on their own network
4. NextDNS filtering on the router
Sources:
[1] ACR study: arxiv.org/abs/2409.06203
[2] Cost of US consumer goods: aei.org/economics/chart-of-t…
[3] Vizio Q3 2024: sec.gov/Archives/edgar/data/…
[4] Texas v. Samsung: texasattorneygeneral.gov/new…
Alex Hung 🤔 retweeted
Richard Winters and Easy Company at the Eagle's Nest in the Bavarian Alps, 1945.
Alex Hung 🤔 retweeted
These manufacturers are exposing themselves to the mother of all class actions.
Most voters aren't yet aware of it. If I tell family or friends, almost none have any awareness.
Alex Hung 🤔 retweeted
so when everyone thought Facebook was spying through your phone it turns out tv makers were the ones doing it all along, this is a nightmare
Alex Hung 🤔 retweeted
Never seen a more flagrant and violent breach of privacy in my life, and probably never will. Doubtful that a privacy violation will ever even be able to compare to the scale of this evil and deliberate attack.
Samsung should be eviscerated for this. Criminal charges please
Alex Hung 🤔 retweeted
For years people have said "no the ___ isn't listening, that would take up too much bandwidth"
pretty clear for a while that you don't need full recordings, just NN detection of key phrases, feelings, vibes run locally then exfil is piggybacked on the next check-in.
if done right you can also make custom nets for individuals and ship them with the next update for more refined targeting. Bandwidth use is tiny and it's super effective for targeted ads.
it's nice(?) to be proven right about a paranoid assumption
Alex Hung 🤔 retweeted
Students at Cornell put up these signs around campus... from @ buffalopotholebandit on Threads
Alex Hung 🤔 retweeted
my samsung TV really embraces feeling home, by discovering it!
a cool service called wifi-presence implements an ipv4 ARP probe loop, starting after 20 min, repeating hourly.
finds ip & mac addresses. a decompile of wifi-prescense hasn't found any code that respects user opt out flags.
neat.
Alex Hung 🤔 retweeted
another development :)
my samsung TV loads a region specific convolutional neural network (LogoCNN.bin, cnn.mapping) which tracks your usage in app.
like in youtube it's looking for videos you watch, ads you skip, progress in a video, etc.
so glad they're interested in me.
Alex Hung 🤔 retweeted
so i figured out why my samsung TV is so sluggish.
samsung uses your own hardware for post-processing of data including audio, screenshots, and your aid (your cross-device tracking ID) and more telemetry.
computer vision processing and models run on your TV.
Alex Hung 🤔 retweeted
PSA: This week was kind of a turning point for AI and cybersecurity. Please take this weekend to do some simple cleanup for your family. Some suggestions:
- Set up a password manager like 1Password and give your spouse or partner access to a shared vault. Teach them how to use it.
- Update your passwords for critical stuff - your email account, your bank or financial stuff, etc. Store in your password manager and use the strongest password you can.
- Use two factor auth for everything you can. SMS is not ideal although better than nothing. Google Authenticator or a passkey is better. Hardware key is safest.)
- Add a sim pin to your phone. Makes it harder to sim jack.
- Update your phone and your computer to the newest releases. Turn auto-updates on.
- Freeze your credit - takes 5 minutes.
- Get an IRS Identity Protection PIN.
- If you’re using claude code or have AI agents that browse the web, they’re probably using Node.js. It’s also vulnerable. Update claude code, update node on your machine.
- If you’re building stuff on your computer, ask claude or grokbot (which is connected to twitter and likely has the most current info) to audit any of your repos for vulnerabilities. Ask grok to make it a scheduled task so it can do this daily - things are moving very quickly in the space right now.
- Consider some light resiliency stuff. This probably sounds silly, but it sounded silly at the beginning of covid too. Having printed out copies of important stuff - especially financial accounts. Having some cash on hand. Having some shelf-stable food and clean water or a water filter. Having a map. Having a generator that can at least power your fridge or some devices. Cheap insurance.
Again, I don’t want to alarm people, but I was taught that you should have a Secure plan, a Comfortable plan, and a Wealthy plan. And it seems pretty clear the secure plan needs to now factor cybersecurity risk as a legit threat. Take a weekend and shore yourself up.