Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Canadians Are Running Out Of Time To Oppose The Dangerous C-22 Surveillance Bill
EFF's Joe Mullin warns that Canada's Bill C-22, the Lawful Access Act, has passed the House of Commons and now sits before the Senate, and urges Canadians to oppose its expansion of surveillance powers and cross-border data sharing with US police.
2 min · 395 words
Should Police Wipe a Criminal's Cellphone Before Returning It?–U.S. v. Stathas
Eric Goldman analyses U.S. v. Stathas, where a court considered whether data on a convicted defendant's seized cellphone, used to commit the offense, should be wiped before the phone is returned, and what that means for forfeiture of digital data.
6 min · 1,363 words
Dark Enlightenment: The Authoritarian Trajectory Being Taken by Tech Giants
Sydney Criminal Lawyers argues that Silicon Valley elites are normalizing Dark Enlightenment ideas—technocratic rule, privately run city-states, and hostility to democracy—with little pushback from authorities.
5 min · 1,160 words
Israeli ad-tech company was a delivery system for "mercenary spyware"And they used Google, Facebook and every other major ad platform to do it.
Cory Doctorow unpacks Citizen Lab's "Exposing AdFection" report on an Israeli ad-tech firm whose targeted ads, served through Google, Facebook and other major platforms, delivered mercenary spyware, and argues everyone should block programmatic ads and that surveillance advertising should be banned.
5 min · 1,140 words
Mac and iOS developer Jeff Johnson explains why he still avoids passkeys and sticks with randomly generated passwords. Even with the new credential exchange protocol, he argues passkeys tied to iCloud Keychain fail his requirements of logging in from an unfamiliar device and keeping independent backups, and that big platform vendors oversimplify security for everyone.
6 min · 1,273 words
Scott Helme responds to the viral 'Passkeys are a trap' post, explaining what passkey attestation actually does, why it rarely restricts users in practice, and why passkeys remain the best protection available for accounts.
4 min · 880 words
Just say no to OpenAI and Anthropic
Security engineer Micah Lee argues against paying OpenAI and Anthropic, citing the frontier labs' AGI ideology, and explains why open-weight models (e.g. GLM) are now good enough for complex work, with private inference options like Tinfoil and cheap ones like OpenCode Go.
7 min · 1,529 words
When No ID Means No Internet: Age Verification and the Right to Access Information
EFF examines who gets locked out when age verification laws require identity documents to go online, surveying new mandates in Australia, India, the UK and US states and arguing that ID-based checks exclude people without documents and threaten the right to access information.
5 min · 1,071 words
Meta's Muse Is An Adorable Privacy And Security Dumpster Fire
Karl Bode argues that Meta's agentic AI assistant Muse, launched with a zero-day flaw that let attackers spy on Mac users, shows how tech giants are rushing out highly privileged AI agents with little regard for privacy or security while lobbying against regulation and open alternatives.
4 min · 825 words
Authoritarian tendencies of Android Developer Verification Program
Vikrant Singh Chauhan argues Google’s Android Developer Verification Program, sold as malware protection, centralizes who may ship apps and threatens sideloading and small open-source clients—drawing on his experience publishing ivx/ai Chat.
9 min · 2,029 words
Site-Blocking Will Not Defend IP, No Matter the Bill’s Name
EFF's Katharine Trendacosta argues the DEFEND IP Act, like earlier US site-blocking bills from SOPA/PIPA onward, would incentivize censorship, overblocking, and bad-faith blocking while giving targeted site owners no real way to challenge orders.
2 min · 563 words
Respecting your users' dread of the clankers
thoughtbot's Dave Iverson argues AI products should let skeptical users opt in rather than opt out, laying out design and strategy techniques such as progressive opt-in, just-in-time consent, pre-approval, clawback, and agents that reject PII and secrets.
6 min · 1,306 words
Kev Quirk finally leaves Firefox after Mozilla’s AI push, tries Vivaldi, and lands on Brave—covering extensions, sync, and why privacy-default browsing finally stuck.
2 min · 528 words
DraftKings Is Using AI to Supercharge the Harms of Online Behavioral Advertising
EFF argues DraftKings' use of betting data and ML to re-engage losing gamblers shows why all online behavioral advertising—not just third-party data sharing—should be banned.
3 min · 609 words
Ethan Hawksley argues passkeys excel against phishing and breaches but are a poor fit for personal accounts: lockout risk, hardware-key limits, Big Tech sync bans, and fragmented third-party UX still outweigh the day-to-day threat of AiTM proxies for most individuals.
3 min · 786 words