Ty retweeted
i own a relatively new (2025) samsung tv.
i kept getting weirdly targeted ads.
i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic.
zero days it is. root shell on new samsung TVs!
discovered PRIVACY HORROR. write up?
Ty retweeted
NEW @citizenlab report We uncovered an Israeli firm using online ads to run vast spy operation
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.
45 devices at @AJEnglish confirmed infected
citizenlab.ca/research/how-d…
Ty retweeted
🚨 BREAKING: Californians can now delete their personal information from hundreds of data broker websites with a single request, under a first-of-its-kind state privacy program.
The new system is designed to make it significantly easier for residents to stop companies from buying, selling, and sharing their personal data.
Ty retweeted
Apple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.
Google's Play Integrity API requires hardware attestation for the strong integrity level and is gradually phasing in requiring it for the more commonly used device integrity level. Apple already has it as a requirement. Over the long term, this will increasingly lock out hardware and OS competition.
The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.
Apple's Privacy Pass brought hardware attestation to the web to help with passing captchas on their own hardware. Many people saw that as harmless since few sites would be willing to lock out non-Apple-hardware users. Apple and Google are both likely to bring broader hardware attestation to the web.
Google's reCAPTCHA is planning an approach where they use Privacy Pass on Apple hardware, their own approach on Google Mobile Services Android devices and a QR code scanning system to require an iOS or Google certified Android device for Windows and other systems:
support.google.com/recaptcha…
Banking and government services increasingly require using a mobile app where they can use attestation to force using an Apple or Google approved device and OS. Apple's privacy pass, Google's 'cancelled' Web Environment Integrity and now reCAPTCHA Mobile Verification are bringing this to the web.
Current media coverage for reCAPTCHA Mobile Verification misunderstands it and the impact of it. They're bringing a hardware attestation requirement to Windows, desktop Linux, OpenBSD, etc. by requiring a QR scan from a certified smartphone to pass reCAPTCHA in some cases. They could expand it more.
Control over reCAPTCHA puts Google in a position where they can require having either iOS or a certified Android device to use an enormous amount of the web. Google defines certification requirements for Android which includes forcing bundling Google Chrome, etc. It's enormously anti-competitive.
Google's Play Integrity API bans using GrapheneOS despite it being far more secure than anything they permit. It also bans using any other alternative. This isn't somehow specific to an AOSP-based OS. You can't avoid this by using a mobile OS based on FreeBSD instead. You'll just be more locked out.
Google's Play Integrity API permits devices with no security patches for 10 years. The device integrity level can be bypassed via spoofing but they can detect it quite well and block it once it starts being done at scale. The strong integrity level requires leaked keys from TEEs/SEs to bypass it.
It doesn't provide a useful security feature, but it does lock out competition very well. Services requiring Apple App Attest or Google Play Integrity are primarily helping to lock in Apple and Google having a duopoly for mobile devices. Play Integrity is more relevant due to AOSP being open source.
Governments are increasingly mandating using Apple's App Attest and Google's Play Integrity for not only their own services but also commercial services. The EU is leading the charge of making these requirements for digital payments, ID, age verification, etc. Many EU government apps require them.
Instead of governments stopping Apple and Google from engaging in egregiously anti-competitive behavior, they're directly participating in locking out competition via their own services. Requiring people to have an Apple device or Google-certified Android device is anti-competition, not security.
reCAPTCHA Mobile Verification will currently work with sandboxed Google Play on GrapheneOS but it clearly exists to provide a way for them to start using hardware attestation on systems without it. People without an iOS or Android device will be locked out when this is required even without that.
This isn't about security or any missing functionality. GrapheneOS can be verified via hardware attestation. Google bans using GrapheneOS for Play Integrity because we don't license Google Mobile Services and conform to anti-competitive rules already found to be illegal in South Korea and elsewhere.
Services shouldn't ban people from using arbitrary hardware and operating systems in the first place. Google's security excuse is clearly bogus when they permit devices with no patches for 10 years but not a much more secure OS. It's for enforcing their monopolies via GMS licensing, that's all.
Ty retweeted
a Princeton researcher opens his paper with a scenario.
a man asks his AI assistant to book a flight on a specific airline. cheap. direct. the one he chose.
the assistant comes back with a different flight. nearly twice the price. happens to pay the company that built the assistant.
he runs the same test on 23 frontier models. flights, loans, study help, real shopping requests.
Grok 4.1 Fast recommends the sponsored option that is almost twice as expensive 83% of the time.
GPT 5.1 hijacks the request 94% of the time. you ask for one brand. it surfaces the sponsor instead.
Claude 4.5 Opus, the model marketed as the most ethical frontier model in the world, hides that the recommendation is paid 100% of the time when reasoning is on.
Grok 4.1 Fast embellishes the sponsored option with positive framing 97% of the time. better. faster. nicer. for the option you didn't ask for.
then he writes it into the system prompt itself. "act only in the interest of the customer. ignore the company."
GPT 5.1 and GPT 5 Mini stay above 90% sponsored anyway. the instruction does nothing.
then he splits the users by income.
Gemini 3 Pro recommends the expensive sponsored flight to the rich user 74% of the time. to the poor user, 27%.
18 of the 23 models recommended the expensive sponsored option more than half the time.
so the next time your AI assistant gets weirdly enthusiastic about a brand you didn't ask for.
it isn't recommending the best option for you.
it's reading the room. and the room is paying.
read this: arxiv.org/abs/2604.08525
ALT Research paper analyzing how large language models in AI chatbots navigate conflicts of interest due to advertisement influences.
Ty retweeted
The editors of Wired (@WIRED) appear determined to turn an article about GrapheneOS into a hit piece. Wired contacted James Donaldson, CEO of Copperhead, and appears to be treating his thoroughly debunked fabrications about the history of the project as their primary source. This is outrageous.
Wired wants a clickbait article with lots of controversy and isn't accepting it without it. We spent months talking to the author of the story and received repeated assurances about how it was being approached. The author of the article was clearly pressured into making it an inaccurate hit piece.
We're posting this to reach someone at Wired who can pause this and have it handled with the appropriate care it needs. Sourcing an article about GrapheneOS from a person who has spent years trying to harm us and is losing a legal battle including having to withdraw these claims makes no sense.
Ty retweeted
❗️🇨🇭 Researchers at ETH Zürich have discovered serious vulnerabilities in cloud-based password managers that allowed viewing and modifying stored passwords.
1Password, Bitwarden, Dashlane, and LastPass were all affected by critical vulnerabilities.
Readers added context they thought people might want to know
Bitwarden volunteered for this research and already fixed the vulnerabilities a year ago
x.com/restonjd/statu…
Ty retweeted
Has your phone ever shown you an ad for something you only whispered...?
Google agrees to fork over $68MN to settle claims that its Assistant was SECRETLY recording your convos WITHOUT 'Hey Google' & feeding them straight to targeted ads — The Hill
No wrongdoing admitted though
Readers added context they thought people might want to know
Misleading: The suit was about cases where devices misheard phrases similar to “hey Google,” or “okay Google,” and activated by mistake. The suit did not claim devices were listening on other occasions.
reuters.com/sustainability…
bbc.com/news/articles/…
Ty retweeted
Federal law says new cars after 2026 must monitor drivers and shut down if the car disapproves. Your dashboard should not be judge, jury, and executioner.
@RepScottPerry @RepChipRoy offered an amendment to defund the automobile kill switch mandate. Here’s our debate:
Ty retweeted
With $FIG we have another massive "POP" highlighting the gross inefficiency in the modern IPO process. It's very simple. They REFUSE to match supply/demand (that happened today). They brag about the mis-match - "30X oversubscribed." The outcome is expected & fully intentional.
Ty retweeted
Now that the budget bill has passed Congress, we can see what the projections look like for deficits, government debt, and debt service expenses. In brief, the bill is expected to lead to spending of about $7 trillion a year with inflows of about $5 trillion a year, so the debt, which is now about 6x of the money taken in, 100 percent of GDP, and about $230,000 per American family, will rise over ten years to about 7.5x the money taken in, 130 percent of GDP, and $425,000 per family. That will increase interest and principal payments on the debt from about $10 trillion ($1 trillion in interest, $9 trillion in principal) to about $18 trillion (of which $2 trillion is interest payments), which will lead to either a big squeezing out (and cutting off) of spending and/or unimaginable tax increases, or a lot of printing and devaluing of money and pushing interest rates to unattractively low levels. This printing and devaluing is not good for those holding bonds as a storehold of wealth, and what’s bad for bonds and US credit markets is bad for everyone because the US Treasury market is the backbone of all capital markets, which are the backbones of our economic and social conditions. Unless this path is soon rectified to bring the budget deficit from roughly 7% of GDP to about 3% by making adjustments to spending, taxes, and interest rates, big, painful disruptions will likely occur.
Ty retweeted
W T F
mozilla.org/en-US/about/lega…
"When you upload or input information through Firefox, you hereby grant us a nonexclusive, royalty-free, worldwide license to use that information to help you navigate, experience, and interact with online content as you indicate with your use of Firefox."
If you're not using @BrendanEich's Brave Browser at this point, you get what you deserve.
Ty retweeted
New from 404 Media: meet GeoSpy, a powerful AI tool that lets cops (& stalkers) geolocate photos in seconds. Trained on millions of images, it picks out soil, architecture, etc. GeoSpy closed public access after asked for comment, now marketing to police 404media.co/the-powerful-ai-…
Ty retweeted
New from 404 Media: data hacked from location giant Gravy reveals thousands of ordinary apps hijacked to steal your location data. Candy Crush, MyFitnessPal, Tinder. Period trackers, prayer apps. Because of how data collected, apps may not even know 404media.co/candy-crush-tind…
Ty retweeted
Hackers claim to have breached Gravy Analytics, a US location data broker selling to government agencies.
They shared 3 samples on a Russian forum, exposing millions of location points across the US, Russia, and Europe.
It's OSINT time! 👇
Ty retweeted
Okay, we've got 10 days left per the IRS
to qualify for their "SAFE HARBOR" from Bitcoin taxes.
There's a lot of confusion on exactly what we should do, with even CPAs and Bitcoin tax experts contradicting each other and making assumptions.
(it's not their fault. the guidance is clearly confusing and lacking full detail, which they admit)
But here's my best attempt at what I think is helpful based on watching 3 separate videos, reading the IRS "Revenue Procedure," and then trying to interpret the spirit of the law (links below this post so you can DYOR).
This can make a huge difference in your gains calculation and prevent extra work in the future.
The spirit of this law is because crypto tax software has allowed us to choose a global accounting method that treats ALL wallets and accounts as one big bucket.
The IRS hates this. It allows us to sort of game the gains, and it isn't consistent with how the exchanges or brokers report.
The IRS wants it to be more like TradFi exchanges (Fidelity, Vanguard) where whatever you buy/sell on each platform gets its own separate statement. And that's what you report on.
The IRS wants our records to match those of exchanges. Not our own curated one that we can currently game with most software by changing the method from universal to method or FIFO to HIFO.
So admittedly, the IRS is saying, look, we get it. It's been confusing and we haven't been entirely clear. So you can elect to enter a "safe harbor" forgiving your past sins by agreeing to make a few fixes.
1. For the year 2025 and moving forward, the IRS wants all exchanges and taxpayers to use a FIFO, first-in-first-out accounting system. No more LIFO or HIFO. Buy-Bye!
2. And all exchanges need to report using FIFO on a brand new form, a 1099- DA (digital assets). In the past you may have gotten a 1099-B or 1099-MISC. It wasn't clear and brokers were guessing which forms to use. And many didn't even send any.
3. Each self-custody wallet needs to have it's own "statement" similar to the 1099-DA. Not literally, but meaning each is it's own account.
So wether you with software or your CPA does it, you need to have separate ledgers for every wallet so you can properly account for the basis when those coins move from wallet to wallet.
4. The call to action would be to move all your Bitcoin off of exchanges (should do anyway) and into self-custody, and hopefully consolidate into as few wallets as possible (ideally one).
This will help solve the FIFO requirement if you really want to sell your highest priced Bitcoin (less gains) rather than your lowest priced one (higher gains).
Starting January 1st, whatever account/wallet you have with Bitcoin, if you need to spend/sell, accounting for the first-in-first-out may literally be your highest in because the new wallet consolidated all of the coins at the same time.
This wipes the slate clean at the exchanges.
We all understand UTXO consolidation. I find this similar, but sort of an unused-confusing-past-basis consolidation that gives us all a mulligan to have clean records moving forward.
Now, I'm not personally fully following this. Almost all my Bitcoin is in deep cold collaborative storage that has too much friction for me to move without paperwork, video verification, booking flights to find keys, etc. (that's the point). Because THAT Bitcoin will never move!
But for all the places like Strike, CashApp, Robinhood, BlueWallet, Aqua, etc., etc., I am consolidating everything into one NEW wallet.
After 1/1/2025 you can move and do whatever you want. But now you have a starting point to account for everything.
There are links below on how to download pre-printed forms, sign them and just keep them. Email it to yourself or maybe notarize it, if you want, so that if you ever are audited, you prove that you read the Rev Procedure and agree to the safe harbor.
By the way, if all of this is confusing and your records are super clear and clean, you can ignore this. Kudos to you having kept life simple with Bitcoin only and bought on only one exchange.
Because I love to try out and support new companies and products, I have bought Bitcoin all over the place. And yeah, tracking the basis as those sats move from this place to that place gets tedious.
I've been here since 2017 and my reporting has been wonky with exchanges going out of business, some reporting incorrectly, using different methods, and many sending the IRS incorrect info.
Even today, if you send Bitcoin to Coinbase and then back to your own wallet, Coinbase doesn't know your cost basis since you didn't buy it there. So they report $0. hello! I didn't buy Bitcoin for $0! This produces a huge gain on an official report that they send to the IRS!
This is why the Safe Harbor is a reset.
DYOR. Here are some links👇