Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Announcing Cloudflare OHTTP Gateway
Cloudflare announces OHTTP Gateway, expanding access to its privacy-preserving Oblivious HTTP infrastructure so apps and services can route requests without exposing client IPs to origin servers.
9 min · 2,100 words
Updates to Full Disk Access in macOS
Apple says it will add stronger, more explicit controls around macOS Full Disk Access as capable AI agents make broad access to files, mail, messages, and browsing history riskier for users and contacts.
1 min · 187 words
From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities
SEC Consult's Timo Longin, known for SMTP smuggling, details two From-header smuggling flaws in Apple iCloud's email infrastructure (line-break parsing and dot-peeling) that allowed sending mail as arbitrary icloud.com addresses, plus detection and defense advice and the responsible disclosure timeline through Apple's fix.
16 min · 3,641 words
Building Guardian Pocket: The Local Health Agent You Actually Own
This is Guardian Pocket. It's the world's first local health agent where YOU own the data end to end.
5 min · 1,261 words
Being asked to sanitise Wikipedia entries
Longtime Wikipedia editor Ruben Schade describes getting paid and unpaid requests to scrub contentious material from articles—and draws a hard line against editing for hire or removing valid citations.
1 min · 224 words
Respecting your users' dread of the clankers
thoughtbot's Dave Iverson argues AI products should let skeptical users opt in rather than opt out, laying out design and strategy techniques such as progressive opt-in, just-in-time consent, pre-approval, clawback, and agents that reject PII and secrets.
6 min · 1,306 words
Connecting Agents with Cryptography
Liam Horne explores how MPC, FHE, and TEEs could let personal agents cooperate—matching calendars, comparing salaries, or finding bug-fix peers—without sharing private context, and who might pay for that shared computation.
5 min · 1,096 words
Automatic Transmission — a data-privacy study of connected vehicles
Northeastern researchers (with Consumer Reports) present a large-scale measurement of the connected-vehicle ecosystem: 21 late-model cars and 30 companion apps, third-party trackers, disclosure gaps, and why vehicle data sharing needs more transparency.
7 min · 1,626 words
Your car is collecting more data about you than you thinkNortheastern researchers tested 21 vehicles and companion apps for third-party data sharing
Northeastern cybersecurity researchers, with Consumer Reports, found connected cars and OEM apps sending VINs, location, and emails to advertising and analytics third parties—and call for clearer opt-in defaults.
2 min · 414 words
First Steps of the PLC Organization – Independent Public Ledger of Credentials
A year after Bluesky pledged an independent PLC directory operator, the Public Ledger of Credentials Organization formally exists and takes its first administrative steps.
3 min · 606 words
Kev Quirk finally leaves Firefox after Mozilla’s AI push, tries Vivaldi, and lands on Brave—covering extensions, sync, and why privacy-default browsing finally stuck.
2 min · 528 words
GrapheneOS – When an app is slow
A GrapheneOS user digs into why OsmAnd maps feel slower on a Pixel 8 than on stock Android, and how that search led to CoMaps and broader performance trade-offs on hardened phones.
1 min · 245 words
SB 923 is Law: CCPA deletion rights now reach third-party data
California’s SB 923 expands CCPA deletion to data bought or appended from third parties and requires an online deletion form—what businesses need to change by January 1.
3 min · 620 words
One Piece of Flock Camera Data Put This Innocent Woman in Jail for 13 Days
An investigative account of how a single Flock ALPR hit led Palm Beach County deputies to jail Lindsey Isaacs for 13 days despite a mismatched car color and no damage.
6 min · 1,408 words
Snap Wants to be a State Actor??–Kansas v. Snap
Eric Goldman analyzes Kansas v. Snap, where Snap argues it should be treated as a state actor—an unusual posture for a private internet service normally fighting that characterization.
5 min · 1,143 words
I’m Tired of Being on the Network
Mat Duggan on smartphone fatigue: how always-on networks reshaped attention, relationships, and work, and why stepping back from the phone has become a practical form of self-preservation.
11 min · 2,442 words
How I Could've Accessed 17 Trillion Microsoft Records
A security write-up estimating ~17.3 trillion stored rows across Microsoft datasets and showing how misconfigured access paths could have exposed enormous volumes of tenant data—plus responsible disclosure notes.
9 min · 2,086 words
DraftKings Is Using AI to Supercharge the Harms of Online Behavioral Advertising
EFF argues DraftKings' use of betting data and ML to re-engage losing gamblers shows why all online behavioral advertising—not just third-party data sharing—should be banned.
3 min · 609 words
F-Droid 2.0: A New Chapter for Android Freedom
F-Droid announces version 2.0—the largest official app update in a decade—with a redesigned UI, better discovery and search, and a simpler experience for installing free and open-source Android apps.
13 min · 2,980 words
Breaking Up with Google Play: Why Conversations Is Now Free
Daniel Gultsch recounts twelve years of Conversations on Google Play, why the XMPP client is leaving the Play Store, and what going fully free means for Android messaging and F-Droid distribution.
4 min · 901 words