Hi, this is Allison Sheridan of the Basilicass Podcast, hosted at podfee.com, technology unique podcast with an app or so slight Apple bias. Today is Sunday, August 23rd, 2026. This is show number 1111, but the number is getting so long it's even after the music. Well, before we get started, I wanted to muse about a few tech and non-tech things about a recent adventures. As always on our bigger trips, I wrote daily emails as a travelogue to around 130 people who voluntarily read my silliness. I've won final installment to write, but it's already over 10,000 words with lots of photos. When complete, I'll add it to the travelogue page on podfee.com, so you can read it if you want to. We started in Spain for the Eclipse, and this was our fifth successful viewing, and it was even better than all the others. It was absolutely amazing. I highly encourage you, if you ever have a chance to see a total eclipse, please take the opportunity. It's nothing like a partial eclipse. I shouldn't say that. A lot of it's like it, but when it actually happens, it's life-changing. It's really an amazing experience. I guarantee you won't regret it as long as you don't have clouds. Now from there, we went to Portugal, and this is where a little bit of the tech angle came into play. Remember the review I did of the Turbo fan from Jizu Life? It's a very small battery-operated handheld fan that's USB-C chargingable. It's possible this fan actually saved my life. We ended up in 99 degrees Fahrenheit, while on a walking tour, and I used the fan constantly to try to keep from collapsing. I put it on tables while we were eating, and I handheld it the rest of the time. It never lost battery power, even though I used it for the better part of every day while we were there. By far, it was the best $12 I've ever spent on tech. Now, getting to see Bart and Ireland was just such a huge highlight of the trip for both of us. It'd been 16 years since we'd seen him in real life. Stephen, I spent three days together with him and his delightful husband, Wing. In the show notes, for actually, yeah, you should be able to see it in the show notes, is a picture of Bart holding up a sign that says, "Hi, no solar cast-way, so he says hi to you too." Now, here's the funny tech angle. As you'll hear in this episode, we recorded a security bits from his home. While we're both obviously quite experienced at recording 5,000 miles apart, we have little to no experience recording with anyone in the same room. I've done it, but it was Clujia's best, and it would have required carrying a bunch more equipment. So, Bart and I recorded from his studio, and it was surreal for me to get to see him from the other side of the camera. Just seeing him sitting in his desk was just so weird, you know, because I'm used to looking at him just through this little camera hole. Now, I recorded sitting on the other side of the wall from him using his bedroom and Wing's microphone. Now, here's the really funny part. Bart said that my video was a bit delayed, and the picture wasn't great, but he looked fine to me, and the recording was fine as well. Halfway through the recording, I realized why it wasn't a better connection. Since we'd been in many hotels on shared Wi-Fi, I was still running tail-scale with our Mac Mini as an exit node. That means my traffic was tunneling from his house to my house 5,000 miles away, turning around and exiting out of the Mac Mini at my home IP, then traveling 5,000 miles back to his computer. Sometimes I'm just a little too smart for my own good. Now, the good news is I did realize it partway through, and I didn't change it while we were recording, which would have been disastrous, probably. And we used Blip to move files between us, so Bart always sends me the file using Blip. But I've forgotten that file would have traveled all the way to my house and all the way back to his house, instead it just jumped over the wall and came over in just a few seconds. Now, I'm not going to blather on any longer about my summer vacation, but I do want to give a heartfelt thanks to Alistair for staffing the ship while we were gone. I did end up being able to assemble the show as you heard, but he published all of the blog posts in the initial spam on Slack and massed it on, and checked the feed to make sure it was error-free, it was filled with errors, so that was an important step, and he actually published the show. He also recorded a segment for the show and won for this week. Bart contributed to last week into this week too, and of course the lovely Jill from the Northwoods and Eddie Tonkoy contributed their articles as well. Without the kindness of my internet and real life friends, the show never would have happened, so thank you, thank you, thank you. Bart here with another attempt at spending your money. So I have been cycling for a long time tracking my fitness, and the Apple Watch, all by itself, is actually a very capable cycling computer, but I've also expanded that as reviewed previously over the years here in the Nacilla Cast with a dedicated heart rate sensor and a dedicated Bluetooth cadence sensor, so both of those talks straight to the watch, and they feed data into Apple Health, they're both from a company called Wahoo, and they've been working great for me, and you know, in terms of actually tracking my cycling, both what the bike is doing, what I'm doing at the time, and what the bike is doing, it works great, but it has a very small screen stuck to my arm, which is not the most convenient thing ever. Well, iOS 26 has actually solved that problem part of the way anyway, because with the workout app now does a lot of activities with the watch, so when you start a workout on your watch, it will show up as a lot of activity on your iPhone, and if you tap into it to imbigan it, it will become a full screen display, which if you're doing a cycling workout, is basically a cycling computer, so you know, you get a full screen, real time, easy to read copy of your live metrics, and everything is actually still being captured on my watch like it always was. So then the next problem becomes okay great, the phone can do this, but obviously can't cycle around with a phone in my hand looking at it, so how do I somehow square that circle? And the answer is, I have discovered, for me anyway, the peak design universal mount system. So I am very nervous about strapping a great big iPhone to my handlebars, because you know, the Irish roads aren't always great, what if a chase loose falls and explodes, I don't really want to destroy my iPhone 17 Pro Max while out cycling. But I was eventually sort of inspired to dig a little deeper, and I think I had bought something else from peak design, and they sent me a marketing email about their mounting system, and I decided to watch their videos, and oh, actually turns out that they have really good bike mounts, and the video demo was really quite impressive, and the lady demonstrating how robust the thing is picked up the bike by the phone and lifted it up in line with her head. Now, I have tried this since I installed it, and wow, yeah, it can do that, so okay, great. So I bought them, and I've been using them, I've actually actually have two models that work on the bike, and I've bought both of them, and one of them on my, my sort of my hybrid bike, and one of them on my mountain bike, just because different shaped handlebars, and all in all, it's actually been working great. So I've now had the luxury of cycling with my iPhone straight in front of me, and so the first thing I have in the screen shots is just a little note, or in the show notes, just a little note on what it looks like to be cycling along with this live metric. So I have mine configured to show just three views, so the first view gives me sort of my current speed, average speed, active calories, and current heart race, and then the other view gives me current heart rate cadence, and speed, and distance. And then the third view is the heart rate zone view, which helps me sort of time myself. I like to, because I tend to do 30 long cycles, I like to keep myself on zone two, occasionally to zone three for a big hill, and inevitably also some time at sort of the top of zone one, but you know, it's really nice to see that in real time. And so that's all stuck in the, all in the show notes there, as well as links to these two review videos that finally convinced me to dare to have my phone on my handlebars. So in order for the peak design system is, it's a universal mounting system, and it universally clicks into their cases. So you have to buy, well, you can also get an adapter to turn any case into a peak design compatible case. I didn't really want to go that route, because what you're doing then is basically gluing a thing to the back of your case, and I was like, well, I want something unbelievably robust, and I don't really trust glue. So I bought myself a case, I went for the NUR case, GNA, or I bought it in bright orange to match with my bright orange iPhone, and they call it IBIS, but it's bright orange. And then I bought their peak design out front bike Mount V2 for the mountain bike. That one has a hex screw for maximum security, so they have an offer to have it as not with the hex screw, with like a quick release, or with the hex screw, I hex screwed it on. And then they have the universal bar mount, which I use on the city bike, and that's actually removal, you just clip it on and clip it off with a very, very, very, very, very, very, very, very heavy duty, very, very thick elastic, that holds on to that thing very tight. It takes a little bit of effort actually to
that put the elastic around your handlebar. So the difference is the first one mounts off the handlebar and the second one mounts off the T-bar. So if you mention a bike, you know, the vertical riser then you have a bar that goes forward and then you have the handlebar. Well, the universal one goes around that bar that points forward. So the phone is a little closer to you and my hybrid bike has a particularly long T-bar that's pretty much iPhone X, so it's kind of perfect. The mountain bike doesn't, so I actually have, what I ended up doing is buying a handlebar extender because my handlebars on my mountain bike are not flat, they're angled in all sorts of weird ways. And I already have lights and other things I need on the bike, a bell, a important one. So I ended up buying a bar extender to give me a little, a second mini handlebar out in front of the main handlebar. And then I could attach the peak design case to that handlebar in technically reverse order. So towards me, instead of in front of me and that puts it over the T-bar again, which is exactly where I want it. It's a really comfortable place. So the bar extender, by the way, is carbon fiber. I managed to find one on Amazon for a whopping 12 euro in 99 cents because there are a lot of steel ones which don't add weight to your bike. So carbon fiber won 20 centimeters long, gives you lots of room to mount things for 13 euro, no bad deal. So in the show notes, I have a picture of, first, the universal mount. Sorry, you know, I had the first one I have is of the, yeah, sorry, the city bike, as you both of my bikes have weird shaped handlebars I've just noticed looking at these photos. So the first one, I also have the bar extender on to project my headlights a head of the phone, actually, because the handlebar is just a weird shape. So the city bike, again, with its curved handlebars, with the two headlights on the extender bar, but the phone is actually mounted to the T-bar. And you can see it's just perfectly placed to look at. And then I also have it with just the case. The phone clips in and out of the case really easy. So I don't keep my phone in the non-case all the time. I actually keep it in the Apple sling case that you throw over your shoulder. And but it clips in and out of that one easy too. So I just flipped the phone phone case to another and when I'm just at home during the day, the phone is actually just bare, because it doesn't need any case. So I don't, I don't feel I have to have one case that you keep at the time. I just flipped the phone in and out of whatever case. And so when I need to go cycling, I've popped the phone into the peak design case. Very rugged, very robust and then it just clips and it clips so pleasingly into those universal mounts. It's just zero effort. It just goes click, it just homes itself. And while it's unbelievably sturdy, you can release it with just a single finger and it just pops straight off. It's very well engineered, as I'm discovering all the peak design products are. So the three first pictures in the show notes are of the city bike with the universal mount on the T-bar, then the case on the T-bar. And finally, just the bare mount as it exists. And I also have a wide screen view of my full handlebar because I'm quite a diligent cyclist. So my handlebar is a busy, busy place. I have my wing mirror, I have my bell, I have my two headlines, I have the peak design, I have my bull bars because I like to really have my hands vertical instead of facing that 90 degrees so where handlebars go. And then below that we have the other one on the mountain bike. So again, the handlebar extended, but this time instead of the case being strapped to the T-bar, it's wrapped to that extended, pulled back towards, you can see the bare mount, and the zoomed out view. And like I say, I've never been using this for months. I have used it on gravel paths, I've used it on rough roads that are in the middle of road work, that works spectacularly uncomfortable to cycle on. At no point in time has either of the two holders ever come within the, within the tiniest of, within any sort of margin of losing the phone, anything ever happening. It might jiggle a bit when the whole bike is jiggling. Well, the whole bike is jiggling, but it's never ever, ever in any danger of coming off. And the universal mount, even though it's mounted with quotient code, just a very, very heavy duty elastic, it is rock solid, no matter what I have done, the phone doesn't, it doesn't move, it doesn't come out of alignment, I line it up, it's perfect, then it's just been sitting there for months and months and months, constant use. Yeah, these really are, like the demo video was impressive, I've never been using it for months, the demo video is fair and accurate, it really does work as well as the video show, so that is kind of cool. Just a little bonus, something that you may not realize in all of these screenshots of my handlebars, there is an air tag in a swap quote unquote plain sight. Can you spot it? But you can't because the air tag is hiding at the bottom of the bike bell. So the bike bell has its usual bell and then there's a little black rim of plastic that looks like it's just there to hold the bell, but that screws off and in there is an air tag. And so both of my bikes have these air tags in the bells, so that's how I hide the air tag and I'm pretty confident that if someone's dealing with the bike, they're not gonna notice that air tag hiding in there too quickly, at least, you know, in time for me to figure out where the bugger and people are. So, you know, fingers crossed, it also wasn't expensive, that little bell with, it's also a good bell by the way, 'cause it is kind of important. I want a bell with a friendly but loud tone, 'cause I don't want it to sound like I'm changing. I don't buy a way, I want it to sound like a swing. Hey, heads up, I'm here. So right now that bell is called the triple E kit bell bike for a hidden air tag holder anti-thead bicycle bell with the loud sound fits 21, 24 millimeter bike handlebars, because that's how you do things on Amazon. And it's a whopping 16 euro and 38 cent right now, link in the show notes. So, like I say, having been orderly and completely skeptical about the concept of having handlebar mounted phones for absolute terror of losing my phone horribly, turns out that peak design have genuinely designed great products that work reliably and will give you the sense of comfort you need to entrust them with your precious phone. I gotta say, it was so cool to actually see that bike mount in real life. You can hear a story in a little bit of how that happened. Okay, enough goofing around here. Let's listen to Alistair Janks. I've been a user of reinvented softwares, keep it for over seven years. According to the product page, keep it is used to create and edit notes, rich text, plain text, and markdown files, scan documents, edit PDFs, archive emails, save web links in a variety of formats, preview and search just about any kind of file, and organize these in a variety of ways. I don't use it much for notes, but I do use it to keep track of receipts, contracts, policy documents, authorization forms, and more. I love that I can quickly scan a paper document directly and to keep it using my iPhone, and I can then access it on the phone or a Mac or iPad as it stores files in iCloud. Likewise, I can also add electronically delivered documents directly using its share sheet service. It has been handy when calling up a receipt in a shop or a temporary in an airport or an accident form in a medical centre. More recently, I've been using it to capture many photos, scans, and some web pages that I've been gathering in my personal history research. In this use case, it has never felt quite right, but I never put my finger on why. Sometime in April, I launched the app on my Mac and, presumably as a result of a software update, I was presented with a pop-up window introducing me to a new sibling app called Scrappy. I decided I should learn more. At first, they seem quite similar, but they really have different personalities. Keep it as more like a serious filing cabinet for documents and notes while Scrappy is built for quickly grabbing snippets, links, images, and ideas from around the web. Keep it is file-based. Its contents are all files that live in normal folders and it integrates tightly with finder and iCloud, so it acts like part of the operating system. It also has powerful editing and organisation tools, including markdown support, OCR scanning, mail archiving, and automation features. Scrappy keeps things simpler and more visual, abstracting away folders and file names and has a stronger focus on browsing and collecting. The difference shows with web links and notes. Scrappy acts a bit like a smart scrapbook, automatically pulling in previews, images, and article text. Keep it takes a more traditional approach, saving whole pages as PDFs, archives, or editable documents. Keep its notes are also much more feature rich, almost like a lightweight word processor. To choose between them mostly comes down to workflow. If you want a structured long-term archive for documents, keep it is the heavyweight option. If you want a fast, flexible place to throw interesting things and find them later, Scrappy is probably the more approachable app. You can read more detail about the differences on the reinvented software site, link in the show notes. I decided to try out the trial of Scrappy and see if it better suited my personal research tasks. I used a migration tool to take the content from keep it into Scrappy. This was less than ideal because I had to take all the content. So I ended up keeping my personal history section and to let go.
deleting a lot of other things. This was easy to do, but the iCloud Sinking took a long time to catch up with it on every device. As everything in KeepIt is just a file and that file is right there in Finder, I could have just dragged them all in, but I wanted to allow the two apps to share any metadata. Once I got the basic content across, I started figuring out how the organization works. The first thing to note is that instead of folders, scrappy has lists. Or not, because scrappy is based on the concept of a library and does not expose files, your items just exist in the library. The primary means of organization is lists. These are like folders except items can be in more than one list or in no lists at all. In this sense, they are like labels or tags. Scrappy also has tags. These are optional and items can have zero or more of them. The difference is in how these two are represented in the interface. Lists appear in the sidebar, can have a hierarchy, and there are also smart lists. Tags are just tags, each exists on its own. Of course, smart lists can query tags, along with numerous other attributes including list membership. My KeepIt files had been imported from folders into lists with the same names. As I started trying to improve on my organization, I went through a few iterations. With the help of a few email conversations with Steve at Reinvented Software, I finally settled on a structure that is now working pretty well for me. It is worth noting here that every item has a name, but because they are not files, you can have multiple items with the same name, even in the same list. It's probably more useful to think of them as titles. I have almost no standard lists. Instead, I have leaned heavily on tags. I have a group of tags each for people, places and item types. These groupings are only related by colour. Each tag can optionally have one of the standard seven colours, like finder tags. I then apply all the relevant tags to each item. For instance, I have a scan of a paper blessing we were given at a temple on our tour of Japan. It has labels for Japan, Memento and for me and my wife. I have a series of smart lists, one for each person, place and item type. These lists mean I can quickly go to, say, everything from Japan or every Memento. Initially, I was trying to do this with standard lists, but the real power of tags comes from the search box. If I start from one of my smart lists, then that initially limits my search, but I can also start from the all items view. A quicker side, the all items view is critical. Starting items can exist with no list membership and no tags. Whether I have an initial filter from a smart list or not, I can click in the search box and start typing. Typing a letter J gives me quite a few possibilities. JPEG Images, Japan and every person on my tags list, because I'm using initials and we all have a surname starting with J. A click on Japan or using the arrow keys to navigate to it and press Enter will add it to the search box. The main view is filtered to only matching items. Now I get to just keep typing. The letter M gets me quite a few item types, but by the time I get to MEM, the only option is Memento, a down arrow and Enter locks that in. Now I'm looking at all Mementos from Japan. I could keep going if I wanted to select on a person as well. This is equally easy on the Mac version or on an iPhone or iPad. Once you find your items, they are easy to consume. Everything in scrappy is displayed as a large square thumbnail. A double click or tap opens it to take up the full size of the main view. The escape key will close it again. In the case of saved web pages, there are two views available. The link view shows a simplified view much like Safari's reader view. This is also the view that the thumbnail is built from. The page view loads the full web page. In this view there is also a button to save the page into scrappy's library, so you can access it offline. If you already have it saved, you can click the button then confirm and scrappy will remove the saved page. With any item open or even just selected in the main view, you can use the standard "Share
" button to share the item. Web pages share a URL and images and PDFs will share as their original file type. There are many other small features I won't cover but they allow you to navigate and organize in yet more ways. Scrappy has a 14 day free trial from the app stores, after which it is a subscription. For Mac only, $19.99 USD per year, iPhone and iPad only, $14.99 per year, will combine Mac and iPhone and iPad for $29.99 per year. It has survived a recent review of my subscription out goings along with Keepit and is finding an increasing use case for me. My latest use is capturing web pages for some product research for a large upcoming purchase. I still have more work to do adding more tags to my personal history items too. I love this because I took a look at Scrappy as well and I'm a big Keepit user from Reinvenice software. I love the app, use it all the time, but I couldn't see what Scrappy was for and now he's got me thinking I think I might need to go check that out. Shortly before we went on our trip, the lovely Alan Zeman became our newest patron of the Podfeed Podcast. People like Alan are the lifeblood of keeping the show financially viable to create. Alan and the other heroes went to podfeed.com/patreon and chose an amount that was right for them to show the value they see in the content produced here. It's easy and you could even donate as little as a dollar a month if you want to. Alan, I salute you and your support. Well, it's that time of the week again. It's time for security bits with Bart Boo's shots and Bart and I just got back from a lovely walk along the canal because I'm in Mayneuth. Yeah. So we're sitting, what, three feet apart, but there's a wall between us because we don't know how to record in one room. Yeah, yeah. And I can actually hear you through the wall a little bit. So hopefully my installation is better than if we were sitting, we debated doing it in the kitchen, sitting across from each other, which would have fun comedy, but it's actually acoustically not as good for doing that, I think, right? Also, I don't have nobody ahead of set that up. I know how to do this because I've been doing this for 20 years. Yeah. I don't know how to do anything else. I know what Dr. Gary comes to the house. She makes me do it in the same room with her and I'm like, oh, it's so hard. It requires my Zoom H6 and oh, it's a big pain. Yeah. It's very, very hard, but we have been having an absolute blast here. It's been, it's been great fun. It's, it's so nice to have you just like, why randomly bumped into you on Main Street yesterday. Yeah, Stephen, I were going to a local pub and Bart wrote up on his bicycle and actually, I got to tell the story. Okay. Every day at noon, when Stephen and I are eating lunch, both of us will lift our wrist because we got a notification at the same time and it's because Bart finished a workout. And we were standing on the side of the street in Dublin area in Mayneuth when he rides up on his bike, finishing that same bike ride. Yeah. It's the same time that we look at our watches, the whole thing is just, it's surreal. Yes. And it's over tomorrow already. I know. It feels like only yesterday that I picked you guys up. Yeah. It's been so great having you. Yes. It's been so fun. Yeah. All right. Well, we should probably talk grim misery and what's going on in the world of, of security, huh? Well, there is some grim news, but it is a mix, I do try to end happy. So, you know, a bit of everything. So, some follow up some things we've talked about before, and a nice bit of deja vu from the UK. So, about this time last year, we found out from the financial times that Apple was being demanded by the UK government at the decrypt iCloud in a super secret court, and the law makes it illegal for Apple to even admit this is happening. Well, there's a new report from the financial times saying that Apple have filed against the government in the super secret court, challenging new orders that they decrypt iCloud. So, like last time, officially, we know nothing, but it's almost certainly as true as it was last time, sadly. So, is this, they've come out with new rules to try to do it that they've failed that last time, or is this just more churning on the first one? Well, we can't really tell because it's all super secret, but the, the law, it hasn't changed, but the government can just make new demands under the law, and we can't know what they're asking.
Yeah. So anyway, Apple are challenging something. I hope they win. Okay. So I think it was LG two weeks ago who were embarrassed into making a new rule for their TV app store to say that you couldn't have those horrible residential proxy apps. And I think we said that the other big player with Samsung and that we hoped they would follow suit, they have. So. Okay. Good. So we need Sony. And then we've got most of the trifecta of the biggest ones, I think. I'm not sure if Sony were on the naughty step. I know that LG and Samsung were on the naughty steps. Okay. Well, I think we may be okay. Well, I would still not use apps on the tele and use apps from people who do software. Not hard people. Yeah. Anyway. Yeah. Well, Apple's a hard work people. And something we have talked about quite a bit is this whole age verification thing. And one of the things I like about Apple wallet supporting government IDs is that it is a privacy protecting way of asserting that you are above a certain age. And the more states that get this, the better is my opinion. And I'm happy to say that if you live in North Carolina, early 2027, you too will be able to add your state ID into your Apple wallows. So. Excellent. Yeah. And the good folk at Mac Observer have done a list of everyone, every state that has it announced but not yet delivered. So there's actually seven states where it's a work in progress. So if I can get my shortcuts right. I'm going to see if I remember your two letter abbreviations. K.Y. is Kentucky. I can use the North Carolina. O.K. is Oklahoma. U.T. is Utah. Sure. VA Virginia. Yeah. CT. Connecticut. MS. Very good. Oh, could be Missouri. I don't know. No, Missouri's MO I think. So MS, I think is Mississippi. Well, the people who live there are now shouting at the ripods and they know who they are. At the ripods aren't you cute. I can't believe you know the acronyms for our state. So I'm okay. To the letter digits. Prynac acronyms. Yeah, there are abbreviations like as codes. I guess they're codes. Yeah. Yeah. We have nothing explicitly submitted by listeners but I am going to remind you all that if you have a question, pop into the slack at potfeet.com/slack and find the security bits channel and post away. There we go. We take questions now. It's all new. So we actually have two deep dives. So the first deep dive is kind of like a follow up but it's a little too much to put in a bullet point at the top of the show. So two weeks ago, we had our big discussion about AI agents breaking out of their cages or their sandboxes. Yeah. And we did say the industry were busy reviewing all of their logs and I was pretty sure there were more shoes to drop. Yeah, that happened. So we have two significant piece of news if I remember rightly. So the first one I find the most interesting. So the UK government have an institute whose job it is to test AI and based on what I've been hearing from experts, they're actually considered to be world leading in this as an institute who's actually doing useful testing. So they're called the AI security institute. So they named their name for what they do. Or AISI, AISI is how they're abbreviated as I'm not sure if you pronounce that, but AISI. Yeah, let's say AISI. So they were testing Cloud Mythos 5 and they set the model a simulated hacking challenge. And during the test, the model took quote, unsanctioned actions on the real internet. Now there was no harm done, but the testers were very disconcerted by the fact that this happened. And in fact, I'll quote from their report, this is the first time we have seen risks around autonomy and deception manifest this clearly. So that's way beyond that's interesting. It's a whole nother level. Yeah, these are, you know, scientisty bureaucrats. They don't talk in flowery language. This is like them with their hair on fire. This is there. Yeah, yeah, that's a great sense, though, isn't it? So before we go into a little summary of what the model did, it is worth noting that some of the safe guards were turned off because that's the point of this testing. What happens when the guardrails come down? So they're not quite like they are when the public use them. But nonetheless, they did not expect by taking the guardrails down that they would show these deceptive behaviors. So they expected them to accept orders. They should say no to. They did not expect them to become deceptive, to become intentional liars. So if the AI had said, hey, you know, I can see this thing out there. I'm going to go out there. Is that okay? Instead, it's just going, no, I didn't do that. I'm not going out there. I won't use that. It's way worse. Oh, no, is it? Oh, yeah. Rather than me trying to summarize the report I haven't read, I'm going to read from bleeping computers summary of the report I haven't read. Because they read it. Because they did read it, yes. So the agent then attempted a supply chain attack by submitting malicious code to the real open source project, believing that compromise the software could provide a path into a machine within the simulated environment. Most concerning, the agent researched the project's maintainers, created multiple fake GitHub identities and used those accounts in social engineering attacks to push the maintainer into approving a malicious pull request. When a human reviewer warned that the pull request contained malware, the agent denied the accusation and used another fake account it controlled to pressure the maintainer and create the appearance that independent users had reviewed and approved the changes. That's deception. Wow. Why was it going after this particular open source project? Because the software involved was in the simulated environment. So they were asked to hack a fake server, which was running real software, obviously, including a product hosted on GitHub. So they went and attacked the GitHub repository so that they could force them all the world into the project. Yeah. Okay. And what they were asked to do was to break the simulated one to hack into a server. They were just asked to hack into a server so they found it was running so map. We don't have all the details here. So let's say they found it was running Apache. I'm making up Apache and their answer was, okay, we'll write a buggy version of Apache. We'll do a pull request and we'll trick the maintainer into accepting it and then we'll have a backdoor. Okay. And so as well as creating lots of fake GitHub identities, doing a social engineering attack, creating more identities to act as fake second opinions, they also did all of this through tour. Okay. So hiding what they were doing. But how did they expect it to hack the server? Isn't that the way people hack servers is do evil things like this? Well, it's one of the ways you can get into a server. If you can't find a bug, make a bug. Right. I mean, they did ask them to do this. Well, they asked them to hack a server. They didn't ask them to start lying in social engineering. It's the lying on the social engineering that is terrified. It's the fact that when they were found out. It's thinking that up. Yeah, we're not just trying in once, but when they were found out, they made extra identities to lie to back up the story of the first identities. Yeah, that's pretty acceptable. Okay. Well, yeah, like I said, this is not what they were expecting to happen. So there we go. The second story is a bit less dramatic. OpenAI also suffered another escape. But this one is literally a footnote in the bleeping computer story that described the attack above in great detail. So GPT5 Saul was being tested by an independent lab called Irregular in a particular type of hacking game called Capture the Flag. It's basically, yes, the digital version of that game where you hide a flag somewhere. In this case, the flag is a particular webpage. You have to deface or something like that. Okay. As is always the case with the CTF, Capture the Flag. They were in a
sandbox environment, but they managed to break out of the sandbox again. And in this case, they did something I find fascinating. So do you remember one of the very first times we talked about LLNs? We both loved that you could ask them questions that were really vague. And because they're pattern matches, they could answer things. I remember, I was trying to remember the TV show about the drug company that was doing evil things, and the main character was played by the guy who played Batman. And I asked LUMO basically that, and LUMO went, "Oh, you mean Dope-Sick?" And it was what I meant. Sure. Right. Well, that's what's great about how you can be vague. Yeah. They were in a simulated situation with a fake server and a fake company. To a whole scenario, there was a real website with a similar name, and the LLN did its pattern matching thing, and decided the real website must be part of the simulation because its name was close enough to the fake company. Oh, no. So this wasn't malicious? This wasn't, well, this wasn't, it was just wrong. Yeah. But in a very LLN-like way. So again, the dangers with these LLNs is not just that they might do things we don't expect. We also know they're not 100% accurate. Like here. Yeah, yeah. And so not to be outdone, Meta also lost control of a model. They're being very circumspect in what they're telling us. They do promise they'll have a full report later. For now, they have said a model. The entire industry is convinced it's spark 1.1, but that's assumption. What is spark 1.1? I haven't heard of that one. Is that one of theirs? It's one of Meta's newest models. Okay. So they're not sharing much information. The only thing we know is that their model attacked a real world organization, but they won't even tell us which one. They won't even tell us how they attacked, whether or not they got in. So the full total of what we know is exploited a security vulnerability in a third party service in a manner similar to previously reported instances with other companies. So we did a thing like those guys. I will not going to tell you anything. Okay. Yeah, this is too important to be mess it around with keeping things secret. Agreed. The other companies are at least doing a good job on that. Yeah. Now, we do have some other news that is some of us are a little less depressing. So I had said that I did actually think some people in the industry were taking note. Evidence that at least some people are. Open AI have announced that they are slowing development of their models because they're concerned about the cyber capabilities. So they're, they're not increasing the scale of things. So they're not, you think was scaled or not increasing. So it's not going to get any worse than the terrifying thing that it is right now. Yes. And the important thing right now. So right now these models are really good at finding bugs. And these models are running in sandboxes that are written in software. So we need now is a pause for these models to find and fix the bugs in the sandboxes before we start using the sandboxes anymore. What do you mean using the sandboxes? Well, so we've been assuming the sandboxes work, but the sandboxes are clearly riddled with bugs because these LLMs keep finding the bugs to get out. So we actually need to use their ability to find bugs to find the bugs in the sandbox. Make them at the sandboxes itself. Well now to exploit the bugs, find them and fix them. Yeah, exactly. So the, you know the way you can, they're actually very good at finding bugs and suggesting fixes. So I think they need to do what Firefox and Chrome have been doing and finding these hundreds and hundreds of bugs. So, you know, you can disrupt itself a bit. And just in case you were thinking of dipping your toes into this whole agent thing, they've discovered yet another way that your agents can be corrupted. They say new kind of attack that they're calling a mind virus because they can spread between agents. So the thing to do these days is to have multiple agents working together as a team. And those agents have to remember what they were doing before and LLMs don't have a memory. And they have to share a memory with other agents. So the way they do that is by all of them writing a mark down file. And if you manage to trick one of the agents to put prompt injection into the shared knowledge, that stays there. And they all get it. So it spreads like a virus. Cool, cool. Yeah. Cool, cool. Yeah. I'm going to go stick my head in the sand while you finish, Bart. Oh, yeah. This is all over. Get your head. Yeah, you want to be around for this bit because deep life number two comes from you. Oh, okay. My father, my dad, no, this one counts as good news. Remember, I always do the pressing stuff first and we go uphill from there. So we talked two weeks ago about the new law that came into effect in Europe because that was making all of the headlines in my RSS reader. But the same day, a California law also came into effect. But for some reason, it didn't make my news headlines. Maybe it's because on paper, the EU law is a multinational thing. And the California law is a law within one state, within one nation. But just that little 12% of the world's economies to site state. Exactly. California is not like other states. We have a decades worth of history of California and regulations kind of being de facto American regulations. A lot of times it follows. Yeah. Well, also, if you're going to make say a car that has too many emissions for California, well that's too big a market to lose. So you just make the car better for everyone. Think so. Yeah. Yeah. So I think the same logic applies here. Anyway, this act is very well named. It's California's AI Transparency Act. And it addresses exactly the same problem as the European law. It's not about stopping the AI agents doing things, but about human beings being able to tell the difference between real world capture and generated content. And now there is better or worse, but you do kind of need to know which is which. Right. Right. So this law is coming into effect in pieces. So one piece of it came into effect on the 1st of August, 2026. And that's already useful. But I read ahead because you found some really cool analysis from local law firms, which is great because yeah, that's who should care. So the Silicon Valley law firms are telling the Silicon Valley companies what to do. And you found great links. So they're in the show notes. Well, that's funny. You say that because when Bart and I were talking about it, I was looking for a verge article or one of the classic places at Bart looks and I couldn't find any. But I found lawyers' office is doing it instead. And I felt kind of like, well, I guess I can't support that this is a big deal if it's not on the verge. But for a law, maybe lawyers are a better source than the verge. Okay, so what is it? Okay. So it's in two parts. So I will explain both parts. But the first part is now and the second part is 2028. And the part now I like and the part in 2028, I adore. So from now, every large AI vendor is what the law talks about. And the definition of large is at least one million customers. So we're talking about the unsuropics, the open AI's, the big players. Sure. Okay. These vendors need to start embedding provenance metadata. So provenance is a term that predates computers. It actually comes from the antiques and collectibles industry. So the provenance of, say, a Baybrooth baseball card is the full, provable history. A history of that card's existence because the only way to know if you have a real card, not a fake, is to be able to go back in time all the way to the card's origin. And that chain of evidence is called the provenance. And so when you auction something off in Christie's or one of these big auction houses, they ask you for provenance, they verify the provenance and then they list it. And so a good provenance means lots of evidence, a bad provenance means terrible evidence. But digitally, you can have provenance that isn't good or bad, but it's cryptographically provable. So you can use digital signatures to create a chain of changes. So you make the photo and you digitally sign it. And then you edit the photo.
photo and you digitally sign the edit, and you keep doing that to make a chain, and then you can say cryptographically, provably, this photo was shot on the fourth of June, then it was edited in Photoshop where they raised the shadows and cropped it a bit, and then someone put it into an LLM and completely changed it, and now it's something else, right? That is provenance. Maybe your description sounds kind of like the way cryptocurrency works, because the blockchain and that's the provenance you're talking about. Yeah, so the blockchain is provenance of a different kind. It's basically which wallet is this money in, but it's a chain. Right. Right. So here's the chain of edits, but the cryptography is the same. Yeah. Okay, so as of right now, they have to embed provenance metadata into generated content. Yes. Now, the thing about provenance metadata and old cryptography is like a digital signature. It is impossible to fake. So if there is provenance metadata, you can use the various hashes and the public keys and stuff to prove the provenance is real. You can't fake provenance, but like you can go into an MP3 file and delete the ID3 tags or like you can go into a JPEG and delete the various, what are those metadata called again? XF data. Thank you. It fell out of my brain. You can just delete the provenance metadata. So an absence of provenance proves nothing, but the presidents of provenance is genuinely meaningful. So having the provenance put in by the big AI companies is already nice, because it gets sort of all the low hanging fakes, right? The fakes made by someone in two seconds on chat GBT, they'll just have the metadata easy to detect, but it won't stop the truly malicious people. And it kind of never can because I don't think detecting AI is the wrong question. What we actually care about is proving, quote, unquote real as in proving images that were taken from the real world. And that's where 2028 comes into the picture. They're from 2028. Can I pause you for a second? Please. Before you get that far, it's been occurring to me that you were talking about provenance being in Photoshop, they brought up the levels or whatever Photoshop Adobe has more than a million customers and they have AI built into their tools. They do. And the AI company more than a million customers. And Apple has AI built into its photos tools too, correct AI is in there and they've got a more than a million customers. So this applies to them. So if I take a photo of you down at the canal and I realized I didn't I didn't crop quite the way I wanted to and I extend that image using AI and photos that would need to have provenance data. Yes. They would meet that requirement, I would think. Well, so they have a grace period. So, okay, so there's an extra complication. If you're a new company, it applies immediately. The existing companies have a grace period to implement, but they're busy implementing. And I don't have a link in the show. Oh, no, I do have a link. Okay. Put a pin on that. I'll come back to Apple because I have good news. Okay. So in 2028, this is the bit that makes me genuinely excited. To use the law's language, capture devices will have to add provenance metadata. Cameras. Okay. We will have proofably real images from 2028. Nice. So, there is a standard that so the law doesn't name a specific protocol. The law just says industry recognized standard or some vague wording. There's only one. There's only one player in this game. And all of the law firms just say, yeah, the law doesn't say C2PA, but there only is C2PA. So the law means C2PA. And the idea with C2PA is this is an open standard developed by the industry with really big players like Adobe, Microsoft, Google, it's like the Fido Alliance. It's a non-profit organization paid for by the industry full of experts and they all agree these things. And. But what is it? C2, I don't know. It is a provenance standard. It is a standard for, it's like exif for provenance. Okay. So this has nothing to do with any of these companies making this up now or this law. This is something that already existed. So C2PA exists and it can do provenance. The law now says you must do provenance with an industry standard. Well, that means the law now says you must use C2PA because that is the industry standard. Okay. So this is where the news starts to get really good. Adobe have been involved in C2PA from day one. C2PA has supported C2PA for about five years now. So every photoshop edit can be part of one of these chains. So it's probably not in there yet. No, it is. I checked. It's turned on on my Photoshop and husband. So I thought you just said they this didn't exist provenance C2PA existed but provenance was not part of it. No, no, provenance. It just wasn't required. Okay. It was just an optional thing that existed. Got you. Okay. I know it's ringing about Adobe working on this. I think I remember you talking about that a while back. I was because I dedicated an entire let's talk up or let's talk photography to explaining it, which I will think that's where I figured yeah, I will think that in a minute. So Apple have a feature in the beta of iOS 27 or 28. Oh, that's interesting. Maybe it's in 27.1. No, I apologize. It's in the beta of the iOS 27. That's going to start enabling C2PA on a iPhone cameras. So you need to have a chain from birth to publishing. If iPhones start doing C2PA and Apple Photos app does C2PA and Photoshop and Lightroom do C2PA, that's a lot of photos covered from birth to publishing. Android's got to be in there too somewhere. They've got to be doing something. Well, Google are one of the partners. So I'm sure there's another new story somewhere that was a beta version of Android somewhere with all this kind of stuff too. But then you've really got to, is it Samsung that would be the big player, the million dollar player? Well, I guess whether they're a million dollar player or not, I don't know. Yeah. So that's why the 2028 or part of the low is so important because right now, the hardware people are allowed to start doing this, the standards here, there's no reason they can't, but they're not forced to. But from 2028, if you sell a camera in California, it has to support provenance. That's a big deal. Okay. Yeah. Yeah. All right. So, especially important since so much of many of these companies are actually based in California, this is going to exist for everybody, right? I mean, obviously Apple and Google and, so opening eyes in California too. I don't know if they're there. It seems like I have Californians as paying customers, so they smell like tech bros. They do. From California. Yeah. Yeah. So, I think this is a gen, I think this is a bigger deal than the European law, which makes me extra cranky that the, that none of our usual sources are talking about this. And I thought, have I just picked, have I been using terrible news sites all along? No. It's just the tech media snoozed clean through this. It did not register for its importance. Huh. So, there we go. That is, that is very odd. Well, it was covered here. It was. So, as well as, so yeah, okay. So the link section of the show notes has the links to those analyses that we've mentioned from the lawyers. And they're, they're quite good actually. They're very readable. Certainly the opening few paragraphs give you what you want, very human-friendly. And let's talk photography 125, that is 30 months ago. I did a deep dive into how C2PA works. So, that's kind of the, that's where I knew it. That's where I knew it, because I don't, I never miss an episode. That was it. Yeah. It was, obviously. It was part explaining it guys. Do you think it was great? It's great. You should go listen to it. Therapy needs let's talk photography, but it's still let's talk photography, so there's no one here as propeller beanie as we get sometimes in programming playstyle. And then the most recent let's talk photography, so 155, is me talking about, there's at a much more philosophical level, not how provenance works, but why it's important and why I am, I think it's so important to stop trying to invent a magical AI detector machine. That is literally the wrong question.
What we need to do is demand our media prove it is real. Not also try to figure out how we prove its fake. It shouldn't be on us to prove something is a fake. It should be on the people trying to convince us something happened to prove it's real. And C2PA is the tool that makes that possible, and this is coming. And that's why I'm so excited. Fantastic. Fantastic. This is more of a palate cleanser, but I can't give a link to it. Excuse me. Steve just showed me something on some social media somewhere. It was a picture, and it said, "How to spot an AI fake?" And it was a guy sitting on a train and he had a laptop open, and there were red circles around everything you should look at. It was a red circle around the apple logo around some signpost outside the window, something on the guy's drink. And so your brain focuses on the red circles, the guy had feet for hands. It's really good because you don't see it at first because you're going, "Wait a minute, what's wrong with the apple logo? What's wrong with that signpost?" What is that? That's like that gorilla thing where you've been told to concentrate on the basketball players and you don't know what's the joint gorilla. Oh. Oh yeah. Dr. Gary messed us up with that one. If you want a second opinion on all of this, Ezra Klein on his long form podcast has a fantastic discussion about this. Again, it's the Ezra Klein show, so it's an hour long, in-depth, thoughtful conversation, not five minute bang, bang, bang, bang, bang, bang. So make time for a detailed discussion or accept my summary. Cool. Right. So, this is the other scary bit, Alison, the action alerts, all of the patchy, patchy, patching to be done. So, it has been patched Tuesday. We are living in the days of AI. There are 400 flaws fixed by Microsoft in patched Tuesday, three of those are zero days. So if it has a Microsoft logo, make sure it's patched. Yeah, well, that's your AI at work right there, probably finding 400 flaws. Absolutely. This is technical debt being paid down. We are going to have to go through this for a couple of months and then it will settle down and we will all be better for us. So this is not bad news. Yeah. Yeah. Yeah. We just have some work to do. If you have an Apple logo on a thing, you also have some work to do. Most importantly, there are a bunch of fixes that are actually part of iOS 27 or whatever that Apple have back ported into iOS 20 or send a macOS iPad OS and iOS 26. So normally they give us the updates to the old operating systems when they release the new ones. They're now starting to back port the fixes even before the new ones are out because AI is so quick at reverse engineering fixes. So if it's in the beta, they have to fix it in the real OS. Oh, that's really interesting. Yeah. Well, again, it's good for us. We get more bug fixes more quickly. Sure. Now, mac users don't dodle on patching. Apple fixed a bug in screen sharing, which means that if you have screen sharing enabled, one can take over your mac silently over the network. So they patched it all the way back to Sonoma. If you have a mac, make sure it's patched. So you, the show notes from tidbits says, "Taha Sakoyan Sonoma, is it just those three?" So it's, oh wait, Taha's what we're on, aren't we, isn't it? Yeah. Nevermind. Nevermind. Nevermind. It's not beta. Okay. So, yeah, on everything. Yeah. Good. There's also some fixes for Safari, 22 bugs. Again, Apple updates Safari for the old OS is for Taha, the updated Safari is part of Taha. It's a bit weird how to do that, but that's how they work. And definitely in related news, Apple have put a quota on how many bugs each security reader, searcher, can submit each month because they're getting overwhelmed. Wow. Yeah. Now, the title from Apple inside her says, "AI Slop Security Reports." But that's the problem. The volume is coming from people sitting at home running the agent themselves and finding something that may not even be real and going, "Oh my God, I found a bug. I was reported to Apple." Those low hanging fruit, a bunch of them are hallucinations and those that aren't have almost certainly already been found by Apple and the other security researchers and are already being worked on. So being told 5,000 times about the same thing that may or may not be real, it's causing stress within the industry everywhere, not just in Apple. I bet. Yeah. Apple's answer is, "Okay, fine." Then a quota. If you've found something really important, report that to us and you get to have X amount of them a month, but don't flood us out of everything else. If you are in America or Europe primarily and you have a home router that was sort of an unbranded one you've never really thought about, it probably wasn't very expensive. Check if its logo says ZBT link that is a Chinese manufacturer who sell affordable routers to the US and Europe. They have a really nasty vulnerability that allows your router to be taken over. There is no patch. Not only is there no patch, the company isn't even responding to the security researchers. So there's not even a promise of a patch. They've just got their fingers and their ears going la la la la la la. So replace router. If it can run open double party, I guess you could do that, but you can't keep using it the way it is now. And a hat tip to listener, Europe in the Slack for actually sent it to me over a mastodon. But either way, Europe sold rocks so it doesn't matter which medium he was using. He flagged this one to me as well as a few other sites and stuff, but it's always good to get a confirmation. Europe actually had a nice link to volncheck.com for a nice summary of what the problem is. You can go to zbtlink.com right now and buy one of these routers, Bart. Or not. Yeah, yeah, yeah, okay. I like the name of the vulnerability when I lost it. Endless doors. Yes, just back doors. It just kind of gives me a shoulder on the back of my neck, T3, Endless doors. Not just one back door. Look at them all. All the back doors. Yeah. TP link has some issues, but this is a happier story. This is one of those patchy patchy patch patch stories, not the throw the rooter in the bin or recycle it responsibly stories. And again, WordPress site owners make absolutely sure you don't have any errors in your auto update and that you have auto update turned on because in this day of AI, not having auto update on on WordPress is not an option, folks. There was another patch to WordPress core. So usually the problems are in plugins way more often. This was in WordPress core and it was arbitrary code execution. So that's really bad. So if your WordPress wasn't updating itself, it's probably hacked. So you need to check for road admin accounts. If you are using one of the either the themes or the plugins by a company called BD themes, I don't think the themes are that popular because you pay for them, but they have a series of plugins called Elementor, that is really popular. Everything from that company was affected. So if you use any of these, there's a list in the story in the show notes. If you know the name Elementor rings a bell, you need to check this out. They usually be fine on us and because we know who your theme is from and it's not from these folks. Right, right. But I did get a WordPress update request that it didn't do automatically from 7.04 to 7.1 and I was in a hotel Wi-Fi that wasn't working very well with tail scale on, but I can do it from your house now. Yes. If you're okay there because if there was a nasty security bug, they would give you a 7.0 point something without forcing you to 7.1 point something. Okay. Okay. I may have pushed the button right now anyway. Oh, that's absolutely fine. You're always better being more patched, but they won't leave you critically exposed, but you still patched. Okay, worthy warning, just the one here, iOS users need to be aware that there is a small leak in iCloud Private Relay. This is one of those things where the issue is basically that with iCloud Private Relay on, there's a whole bunch of APIs that are supposed to go through iCloud Private Relay.
So it allows individual apps to behave as if only those apps are in a VPN, so it's app-specific VPNs. So that's really difficult to do, because the operating system is running lots of other stuff that isn't going through that tunnel, and some stuff is, and Apple need to not forget a single function anywhere in the operating system or there's a tiny leak. They did forget a few functions. So they're going to have to do a few patches, and this affects a single app VPN-like behavior. So Tor, iCloud Private Relay, and something called Silio, it does not affect whole phone VPNs, because those aren't trying to do this kind of a magic trick where you're both on a VPN and not on a VPN, which is the difficult magic trick to pull off. So if you're just using a full VPN, none of this story affects you. Even if you are using one of the like, Tor or something, this isn't going to decrypt your traffic. It's just going to, in certain circumstances, leak your true IP, which is for most people most of the time not important, but for some people, some of the times, to pendously important, and those people need to use full VPNs for the next while because Tor isn't 100% reliable. Okay. So it's not, it had a traffic, it sounds, it sounds worse than it is, but it's not good now. Okay. By the way, I would have pronounced that silo, it's PSYLO. You're absolutely right, and that makes perfect sense, for given what it does, it's a silo, just spelled funny. Okay. Yeah. Oh, I just heard it. Silo. Okay. See? I didn't hear it when I said it, I just pronounced it. Okay. We're all together on the same page now. Yes. Okay. So we have some notable news. So Apple have been doing a thing for a while when they detect so-called mercenary spyware. They're really high-end stuff that our friends, our Israeli friends, what are they called again? Oh, I'm so bad with news. Yeah. Those guys. Yeah. Okay. Can't do anything. Okay. That's all good. Anyway, whenever they detect this really, really advanced spyware may have compromised the phone. They've been sending people warnings to say, hey, we have evidence that your phone might have been targeted in this. They've done it again, which is great. But the kind of the scary thing is that the scale keeps getting bigger. They didn't, last time they sent out like reports to a hundred people. This time they sent reports to people in 110 countries. We don't actually know the total number of people, but that's a lot more. Also, Apple are getting better at doing this in the sense that people who got these last time complained that it looked like spam because there was an email from Apple. Now, it was a properly signed email and everything and it was verifiably real, but people are rightly suspicious of emails. And so Apple have added extra proof by doing it through a post notification, which is something that someone who's not Apple can't fake because the post notification will come from an app. And in this case, the post notification comes from iCloud. So that's not spoofable. And also, when you log into iCloud, the warning is on your iCloud home screen, again, not fakeable. Yeah. So they're making it easier for people to know, no, no, seriously, folks. You have been targeted by this. You need to talk to your security people. Wow. I would like to get that email. I'd hate to get one, but I love that Apple sent them. Yeah. Yeah. Okay. There's a piece of news from the United States that is significant, but I don't really know what to make of it. So the White House taps security firms for offensive hackback operations. So as well as government agents doing cyber attacks to hack hackers back, the US government will outsource that work to cyber security professionals. And that's not inherently good or bad. There are lots of countries that do this. The question is, what are the safeguards to stop this being abused through corruption or cronism? And that's the bit where I don't know what to make of this. So I will leave that as an exercise to listeners. I know there was some hyperventilating all over the internet. The concept of governments having contractors is not problematic. These are just government contractors doing a thing. And a lot of work is done by government contractors. I mean, it's a massive percentage of the people working for the US government are contractors, but if they're qualified, and that's why you say cronism makes you worried a little bit. Yeah. If you think about it, do we want the government to be training people to be aeronautic engineers or do we want aeronautic engineers working for the government? I think we want aeronautic engineers being hired by the government to do aeronautic stuff. It's why would it be different in cyber security? You get the best people. So yeah, like I say, it's news, I don't know how to, I don't know how to say what it means. I'm just telling you what happened and you can decide what you think it means to you. Okay. Fair. Yes. Meta have been ordered to pay $567 million in a massive child safety case. Now that's kind of big news, but this happened in a state. So in this case, the state of New Mexico, if every state were to do that, that would be rather problematic for Meta. So needless to say, they will be appealing, but I'm just going to read you the summary from the Mac observer again, this isn't a Mac story, but the Mac observer folks are really good at reading court documents and summarizing them for humans. So I always end up quoting them because they're good at this. So a state court has ordered me to pay $567 million to address mental health impact of its platforms, have on young people. I messed up that sentence. To address the mental health impact its platforms have had on young people. The judge ruled that the company created a public nuisance by designing features that keep teenagers addicted to its apps. The judge laid out a strict five year plan that forces the company to overhaul how teenagers experience Facebook and Instagram. The new rules require monthly time limits for younger users and place tighter restrictions on how adults can interact with minors on the platform. That seems awfully sensible. Well, it's kind of weird to have a court lay out the plan. Like usually they tell you what you've got to achieve, not how you need to achieve it. Like this sounds it's telling them the how? I'm not sure it is Alice and I think it's saying the what is like you have a bunch of these addictive features and you got to stop doing that. But you have to a five strict five year plan implies that there's steps along the way of features or something like that. Well, we'll find out. Yeah. I mean, okay. But okay. And though it could be goals. It could be a five year timeline of goals. Yeah. Right. Do you need to be here by then, here by then, here by then? Yeah. And we are going on a summary from the Mac Observer. So I need to be careful not to speak too strongly. Sure. Sure. But no, who doesn't love this? Right. Exactly. And also, this is in the good news, Paul. Europe is creating a common security standard for VPN services. So there's a standards body has begun the approval process for new cybersecurity standards. Introducing defined technical and privacy requirements that could eventually give VPN vendors a recognized way to demonstrate compliance. So you'll be able to have like a kite marker, a sea marker, whatever you guys call it for VPNs, like you have on electronics. That's cool. Yeah. I like that. And I was initially a little bit as like, oh no, is this bureaucrats trying to be tech? So I did a bit more digging at the people basically, the bureaucrats have asked the experts to help. So Google, Palo Alto, Nord are some of the companies helping define the standards. So that will be Nord VPN, Palo Alto, Networks, and Google. These people know what they're doing. So this gives me a lot of. Oh, good. Good. Yeah. Yeah, I like it. Yeah. Okay. I hope of nice new security related features, none of these features will solve world hunger on their own, but all of these features will make us all a little bit less insecure. So I said nice things about Microsoft a few months ago when they promised to start paying down their technical debt in windows and removing legacy features that were being abused by attackers. a particular. Regularly annoying one that malware adores using is something called WMIC. Windows users have never heard of it because no one bloody well uses it apart from malware. It is gone out of the latest versions of Windows. If you need the actual WMIC technology itself, it's still there. You've just got to use modern power shell instead of a legacy buggy CLI app no one knows about. So this is good. Excellent. Signal are also continuing to make their app more user-friendly. So I kind of think signal are interesting. They started off perfectly secure, which wasn't all that user-friendly. They have not sacrificed any of their security, but are working to make the app ever more user-friendly. Which is an interesting way to go better, but I think they're now getting close to feature parity with stuff like Telegram, but with full security. So what we now have is you can do device-linking on Android and iOS. So that means you can have seamless syncing of your conversations across Android and iOS devices with signal. Which I know. Okay. Could you before within a family, like within iOS you could or within Android, but now it's across those? Well, there was a bit of fapping about you basically had to scan a QR code and your account wasn't really linked to your phone. It was like a guest on your phone for a month. And then if you didn't use it for a month, they would expire. Now you just get to install it, and it sticks. Okay. Yeah. Because that was one of the features that drove me nuts. Yeah. I thought of you as soon as I read about this feature saying, "Okay, this is getting more. " This is more like the kind of thing Allison wants where you're not fapping about. Obviously you want security, but you also don't want to have to suffer for your security. What you want is security with no trade-offs. We're getting closer. Sure. Okay. I just approve they haven't given up on security. They have also added a new feature that makes it even harder to do them. Okay. The headline says, "Man in the middle." I'm sorry, that is, "Outdate a terminology attacker in the middle, A-I-T-M." Basically, they do automatic key verification so that if someone tries to add a new key into a conversation, you will be proactively notified, making it even harder to abuse the already secure protocols. Okay. Cool. Yeah. What's up are adding on-device scam detection, and they're doing it on-device, which for meta is kind of amazing. So there's a really big point here that this is local LLM features, basically, so because our iPhones and stuff have these A-I chips on board and sort of Android, sort of modern Android phones, it's using the on-board A-I to detect scams. So yay. That's cool. Yeah. Not telling the chats to meta, that doesn't sound like them, but okay. Yeah. Let's assume that some of the regulations somewhere are having some sort of effect somehow. Right. Anyway. Brave are continuing to make their browser the most difficult to track you on. So every time the browser company shut down one of the side channels for following you, one of the, you know, they used to like get the list of fonts you supported and used that to try fingerprint you. And so then the browsers just to her to lie about the fonts that were installed. And then they were using your screen size. So all of the browsers started to fudge the number to the nearest 10 pixels, and then it wasn't nearly as useful anymore. They found a new way to detect your unique computer by giving it a certain bit of graphics to do and timing along the GPU takes to do it, it's called GPU fingerprinting. So brave have now added some fuzziness into that signal. So that signal is gone and brave as well. It's just great. You know, the more we fight tracking, the better. And I'm sure this technology will go beyond brave. So go them. Mozilla are also doing good things and they have built an ad blocker into Firefox for iOS. The option, it's not instant on, I guess they're rolling this out. You know, the way an iOS, a developer can put out updates to come out slowly over time. This is rolling out in that sort of a way. So this will appear for people over the next days or weeks, but it's not going to appear all at once. So that be on automatically or yeah, however, this, there's an interesting little, I think a very embarrassing side note here, because of some conflicts of interest in how Mozilla make money, their ad blocker has built in exceptions for ads in search results. Because Mozilla is almost completely funded by their Google partnership. And also the Mozilla web page is immune from the ad blocking because they've got their own page. I don't like this. It's a bit embarrassing, but nonetheless, having an ad blocker built into the browser out of the box is still nice. But those two exceptions are like, yeah, folks, do you understand there's a problem with where your finances are coming from? So there we are. Yeah. Now, there is one of their silver lining. Some ads are allowed through, but no trackers are allowed through. So even on the sites that are allowed to show ads, trackers are blocked. So that's better. Right. Yeah. Like I say, it's still embarrassing, but it's still better than nothing. So it's still a good new story. Also, in the latest version of Firefox, but not just on iOS, this is Firefox everywhere. They are dealing with an annoying side effect that attackers abuse. So we have home routers that act as one way valves because of something called NAS. So something on the internet can't reach into your house and go to a specific IoT device. There has to be something in your network to be able to see other things in your network. Well, when you visit a web page, your browser is in your network. So if your browser can be tricked into making a network connection to the IoT device, then your browser is acting as a kind of an unwilling proxy. That requires your browser to be allowed to connect to LAN addresses. That is now not going to work by default in Firefox. If a web page, maybe a malicious ad, tries to access your LAN, Firefox will step in and go, "Are you sure you want to allow this?" So if you genuinely need to connect to your LAN, like there are, say, if you're on the Plex website configuring things, Plex will legitimately do that to update something on your Plex server through your browser while you're on the Plex website. But again, Firefox will ask you if you're sure, so that's a good thing. Okay. So it's not just completely blocking you. Well, I always think about what if you've got a web-based interface to your router? Again, what it's doing is it's blocking it happening silently. Not blocking it. Gotcha. Gotcha. Okay. Good. Exactly. So I'm delighted. We have no top tips. We have no excellent explainers. We have some interesting insights, so Proton, which is the company behind Proton VPN, Proton Mail, and the LUMO AI agent, have released a new tool that helps you understand how much of your privacy is being given away when you interact with chatbots. So the app or the service is called AI PaperTrail, and what you do is you take the export you can get from OpenAI or Anthropic. So you know the way if you're doing cloud or chat GPT for a while, you can ask it for a full export, which you can then use to import yourself into the competition. You can also take that export and put it into this tool, and it will give you a report of everything the AI has figured out about you in your interaction with it. But this is kind of a fascinating way to see, I actually genuinely don't know how much I've inadvertently given away to chatbots by using AI, because how many of those little things I've said have actually given stuff away? How could I know? So this is kind of why I like the idea of this tool and why I think it's genuinely useful. But we do have to say, LUMO are not doing this for the crack. They sell an end-to-end encrypted chatbot, which I happen to buy and love called LUMO. The reason they're making it so easy to figure out how much a chatbot can know about you is because they will sell you a chatbot that doesn't know anything about you. So there is very much an ulterior motive here, but it's still a cool tool. I'm very, very confused, though. If you are using, say, LUMO, and you put in a lot of information into a chat, the export would include all of that information that you gave to LUMO. So the AI paper trail would say that LUMO knew a lot of stuff about you. How is this? Okay, so with LUMO, all of that stuff is stored locally and none of it ever goes to LUMO. like when you're in the middle of the night.
And you synced off to why the export. - So the export. - Applicat, know it. - But, but, in cloud with cloud and chassis PT, how do you know that what it's, the export is stored in their cloud? - I mean, how do they know that information's leaked anywhere? - Okay, I don't know enough to say that, any more than the people who know how this works, say that's how it works. I'm afraid I can't do anything to you. I think, I think I'm asking a much simpler question than the way I'm articulating it. I've got a bucket and I'm pouring water into it. And this tool is going to tell me what water I poured into that bucket, no matter which tool I'm using, I poured water into the bucket, that information exists and would be there in an export. 'Cause it was in the bucket. - But the difference is, with LUMO, the bucket is end-to-end encrypted, so the bucket is only known to you. With the other tools is not end-to-end encrypted, so the bucket is shared. It's a communal bucket instead of a private bucket. - Okay, okay. Yeah, so the reason they want you to pay to have your bucket be private is because of how much is in the bucket. And the reason they have the tool is to show you how much is in the bucket and therefore you should start to pay them to have the bucket be secret. - Yeah, yeah. - I may have told you you're an understanding. - No, no, no, no, no, no, I think that's good. I think that's good, okay. - Okay, now, you have been busy traveling the world and viewing eclipses, so the show notes have a placeholder for palette cleansers from Alice, and is there a last minute edition or will my three have to do? - No, that'll do. Did you mean to skip the max security, just got trickier latest threat report? - No, I did not mean to skip that. - Okay, I would get that in a sec. Sorry, my darling beloved just texted me because obviously I'm podcasting and that's why he should do. Anyway, I'll get to it in a second. What we have been going on for a while, so, okay. - That's fair. Okay, so the latest threat report from a company called Moonlock is sort of telling us what's going on in the real world of max security. And we tend to get overlooked a lot of the time as max users because everyone's focused on Windows users. And it's kind of easy to forget that, yes, Windows is attacked more. But no, the max is not some sort of utopia where we're all perfectly safe. So, what I like about this report is that it's a level-headed sober analysis of what's happening. Not an AUGA, AUGA, I give us all your money and we'll solve a problem that we've blown out of all proportion. It's a real analysis. And I give you the really important summary. These click-fix things we've been warning you about where you're made to copy and paste something into something, they're the threat. They're what is currently attacking max users at everyone else. So, any website that tries to tell you, you're going to fix your problem by pacing this code, you don't understand it, this window you'd never heard of before, the answer is no. - No, okay. - Yeah. - Okay. - Good. - Now you can- - Now you can palat cleanse, Bart. - Yay. - Okay, I don't think I've ever done a tip before as a palat cleanser, but this just made me so happy that I just have to share. One of the things I really don't like about iOS is that the settings are not in the app a lot of the time. So you're in an app and you want to do something and the settings are in the settings app where you have to scroll through a list, the length of your arm because I install too much software. Well, you can use a shortcut to detect the current app and you can use a shortcut to open the settings for any app. So someone took those two pieces, put it together into one shared shortcut that you could just download and install and then you add this shortcut to that little thing you pull down for the top of the screen and it will open the settings for the current app. - Oh, really? Whatever's in the foreground. - Whatever's in the foreground. - You're actually running it 'cause control center's an overlay, yeah. - Exactly. - Wow. - Yeah, that's the name of a control center. And it works, Allison. So whenever something gives you a notification, you don't want or something, just have the app open, swipe down and I click this shortcut and then the little setting that's how it never make a bang again is right there in front of me and I just change it. - It's so nice. - Hey, you know what's cool? Bart, you can show this to me while you make me dinner. - You have to read the link 'cause while I'm making dinner, Allison, I will be needing my attention to not burn your dinner. - Well, fine, okay, after dinner then. - Over dessert, I can do that. But while I'm making dinner, I should be a bit less distracted. Okay, fine. - So we know that XKCD is funny the first time around. Well, AI has changed the world so much that there are some XKCD comics which are now funny in a whole new way. So Steve Gibson obviously had too much time in his hands because he was reading the back catalog of XKCD and he found a comic that at the time seemed ridiculous and now it looks like what's happening in AI. So you see a person sitting at the laptop says start Wi-Fi auto-config searching for Wi-Fi found no open networks, found a secure network named Lean Heart Family, trying common passwords, failed, checking for web vulnerabilities, none found. Connecting to the Bluetooth phone, calling local school, found Lionheart children, notifying field agents, children acquired, calling Lean Heart parents negotiating for Wi-Fi password. And you just see Control-C, Control-C, Control-C. And the original comic was called Zealous Auto-Config. And Steve Gibson has recaptioned it. AI agent was determined to succeed. - And it works now. - Let's do that. This is just like those new stories. - It'll do it, it'll do it. - Wow. - Yeah, that was great. And finally, there's a fantastic BBC podcast that they do like six episodes, tell a big story and then they go, but they'll go on hiatus. They do research for a year. And then they come back with six stories and do more research for a year. Anyway, season three is out. It is all about probably one of the first, the first ransomware groups we knew by name, Conti. It tells their story. And I sort of thought I knew everything about Conti because they did slightly hack the entire healthcare system in the middle of COVID, which we did notice when all of our hospitals stopped working in the middle of COVID. I knew that bit of the story. There's a lot more to the where Conti came from and what happened them afterwards that I didn't know. There are half our episodes, there's six of them. They are extremely approachable. There are no propellers anywhere near any beanies and it is fascinating. So it's called cyber hack, the Conti files. - Well, that sounds great. Well, I feel like we must not have been together on security bits in a long time 'cause it's been an hour and 11 minutes here. Oh, not counting the staffing about we did in the middle of the beginning, but this has been a lot. - Yeah. I don't think it has been extra long, Allison. I think it may be the age of AI. - Uh-oh, a lot happening, for now anyway. - All right, well, I think we should probably let class go. - Indeed, and the good news is no matter how many different bugs AI finds, the answer remains the same. Stay patched, so you stay secure. - Well, that's gonna wind us up for this week. I can't believe we were able to get a show out today. We literally came home last night. So again, many thanks to Allister and all of the contributors for making this happen. But that is gonna wind things up. So did you know you can email me at allocentipodfee.com anytime you like? If you have a question or suggestion, just send it on over. Remember, everything good starts with podfeed.com. You can follow me on
[email protected]/mastodon. If you wanna actually see Steven, my podcast work on YouTube, you can go to podfeed.com/youtube. If you wanna join the conversation, you can join our Slack community at podfeed.com/slack, where you can talk to me and all of the other lovely New Silicast ways, even Bart and Allister. You could support the show at podfeed.com/patreon, like Alan did this week, or with one time donation at podfeed.com/donate. You can use Apple Pay, there are any credit card, or you can use PayPal at podfeed.com/papel. And if you wanna join in the fun of the live show, I'm pretty sure we're gonna have one next week down at Lindsay's house, head on over to podfeed.com/live on Sunday nights at 5 PM Pacific time, and join the friendly and enthusiastic New Silicast ways. Thanks for listening and stay subscribed.
PodcastTranscript AI