tomorrow, 8 November, Aaron Swartz should be turning 40 years old

#aaronswartz

# LGBTQ+ Ukrainians fight Russia, but still face discrimination at home | DW News

#OurColorsNeverFade

https://youtu.be/gd7sLVaDpCk

# Apple will soon scan iCloud links for “Harmful Content”

archive.is copy

"According to an Apple support document, the policy applies to anyone who shares iCloud content — such as photos or files from iCloud Drive — through the Share feature, but only when using the option that lets anyone with the link access it (“Anyone with the Link”)."

"End-to-end encryption will no longer apply, nor will previously enabled Advanced Data Protection (ADP), the feature that is supposed to prevent Apple from accessing user data."

https://archive.is/2026.11.06-125857/https://www.heise.de/en/news/Apple-will-soon-scan-iCloud-links-for-Harmful-Content-11515271.html

as someone who manages "middle boxes" professionally, #eMudhra is still terrifying

every linux distro that fetches updates over HTTPS authenticates its mirrors with the same trust store it uses for everything else. while a trusted root is compromised (the eMudhra keys were recoverable by anyone), a state actor with in-line access, like Russia’s TSPU boxes at every ISP or the NSA’s backbone taps, can impersonate the mirror and quietly freeze select servers on stale but validly signed metadata, so the target OS never learns a fix exists. curl, git, API, webhook, SMTP, Java and Go traffic from those servers can be intercepted, since none of those clients check CT or revocation by default and only patched Go and Java builds block the eMudhra keys. debian and ubuntu make it worse by still serving updates over plaintext HTTP by default where singling out ca-certificates updates doesn’t even need a forged certificate

today is the 12th anniversary of Laura Poitras' #CitizenFour releasing in the US

you can download Citizen Four from @internetarchive for free: https://archive.org/download/citizenfour.2014

have you seen it already? here's a side quest: watch it in the context of AI surveillance in 2026

#CITIZENFOUR #LauraPoitras #Snowden #EdwardSnowden #privacy #surveillance #NSA #GCHQ #humanrights #surveillanceCapitalism

✊🏻

"Signal has resolved a critical-severity vulnerability that could allow a malicious caller to keep audio and video tracks enabled even after the user hung up.

The security defect is tracked as CVE-2026-113380 (CVSS score of 9.3) and impacts RingRTC, the open source library Signal uses for voice and video calls, which is based on WebRTC.

Due to the issue, a remote peer could flood the call’s Finite State Machine (FSM) event queue with junk, and the call would not terminate.

This happened because the hangup was not treated as a kill switch, but as an event added to the FSM event queue; there was no rate limit on peer-originated events; and the hangup event had no priority.

“Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down,” a GitHub write-up by a researcher reads.

By exploiting the vulnerability, an attacker could keep the audio and video tracks flowing from a target device while the victim believes they ended the call.

The security defect was resolved in RingRTC version 2.72.0, which was released on September 4.

Details on the flaw, however, were published on Tuesday, along with a conceptual proof-of-concept (PoC). NIST added the CVE to the NVD database on Tuesday.

Signal resolved the issue by ensuring that call termination requests do not remain blocked in FSM’s event queue and are detected independently.

Users should update their Signal applications as soon as possible. Otherwise, they should check the call indicator to make sure the call indeed ended."
https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/

# How Big Tech money is undermining US democracy — Interview with @gilduran

Michaela Kufner: "...and so far he's not even received one legal complaint about the facts he's put together"

https://youtu.be/2176dnVR02E

a nice introduction to ECH

https://growingswe.com/blog/tls-ech

#GlobalEncryptionDay

Wyden: "I write to urge the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) to protect web browsing information from surveillance by hackers and foreign adversaries. Specifically, your agencies should require that federal agencies and technology vendors adopt Encrypted Client Hello, an important encryption technology that protects information about websites that Americans visit.

Government websites nearly universally encrypt website data, protecting the contents of web pages from prying eyes. However, standard web encryption does not protect website names such as “reportfraud.ftc.gov.” As data travels across the internet, hackers and foreign actors monitoring network connections can easily see these exposed website names. This visibility could lead to malicious eavesdroppers identifying whistleblowers, profiling cleared federal personnel, tracking Americans seeking crisis support, and mapping interactions between agencies.

Encrypted Client Hello (ECH) is a cybersecurity technology that protects the name of the website visited by a user. It is particularly effective when used by major Content Delivery Networks (CDNs), which connect hundreds of thousands of different websites to the internet. When ECH is used on a website delivered by a CDN, anyone intercepting a user's web traffic can see which network is delivering the content, but cannot directly identify the specific site visited among the many websites hosted on the same CDN."

#GlobalEncryptionDay

https://www.wyden.senate.gov/imo/media/doc/10192026lettertocisaandomb.pdf (pdf)

Watch the first 30 seconds of this and tell me more about how physical security, exploit mitigation, and anti-theft features aren’t critical technologies, even at the expense of repairability features

# Brazil's phone theft epidemic becomes key election issue

https://youtu.be/RA-7JWxrKNA

what are your lovemotifs with yourself?

what are your lovemotifs with your friends?

https://www.youtube.com/watch?v=UNTZMlgf2To

"this is the call to the resistance"

# How AI disinformation is reshaping our reality | Myriam Francois | TEDxCambridge

https://youtu.be/RDNLX7ngV2A

"without facts, you cant have truth.
without truth, you cant have trust.
without trust, there is no shared reality.
without a shared reality, there is no rule of law. there is no journalism. there is no democracy."

Maria Ressa

"The A19 chip in the new Apple TV 4K delivers [Memory Tagging Extension]"

Apple is giving MTE to smart watches and now home entertainment systems, at the same time as Google removing MTE from its flagship cell phone

@jonah

https://www.apple.com/newsroom/2026/10/apple-unveils-the-new-apple-tv-4k/

"Surveillance is a Weapon"

in the "Resisting Europol & the new age of digital policing in Europe" panel at #PrivacyCamp

#PrivacyCamp26

at a talk by @epicenter_works (🫶🏻) talk about #eIDAS at #FreedomNotFear #fnf26

it will be a centralized system used for so many things. citizenship, identity, age verification, digital euro spending, healthcare data, drivers license, public transport, social media SSO, etc

OMFG F THIS (trauma informed triggers)

Pros:
- a right not to use it
- user-driven consent and selective disclosure mechanism
- over asking
- data accessible to researchers for transparency
- no unique persistent identifiers (as much as some people wanted)
- unlinkability (the first release DOES NOT USE zero knowledge proofs)

Bad:
- right to pseudonymity, but zero policy around what this means, and users cannot lie. so in effect myst be real name. the commission intentionally left this out
- deniability. every data has an attribute provider, the crypto proof used cannot be denied
- biometric identification. zero limits around use, collection, etc. Feb 2026 biometrics (headshot) was added back in, member state defined safeguards may support opt-in or opt-out for this; 24-month wait period before can be forced
- Unobservability.
- ZKPs, two technical implementations are fighting it out for use. 1-2 years before use. Google is one of them.
- open source. back-end exceptions
- device security. burden of proof shifts to the user because the service can claim cryptographic integrity regardless of device status

"According to the public prosecutor’s office, [a] police officer [] from Tilburg is alleged to have sold information he retrieved from police databases for roughly a year and a half. The material in question reportedly included names, addresses, vehicle registration numbers, and details of ongoing police investigations."

#fnf26 #FreedomNotFear #privacy #surveillance #netherlands

https://nltimes.nl/2026/10/11/neighborhood-police-officer-allegedly-sold-names-addresses-police-systems

excellent start to #fnf26, friends and stickers

(like @catileptic holding this wonderful sticker!)

for smaller fediverse instances: https://relay.disobey.net is an activitypub relay that chaos.social is connected to, easy way to stay connected to (probably) where most of the #40c3 posts will come from

https://relay.disobey.net is hosted in the Netherlands by @discotheque