NC_2026_08_23

Hi, this is Allison [music] Sheridan of the Nosiliccast podcast hosted at podfeat.com. The technology podcast with an ever so slight Apple bias. Today is Sunday, August 23rd, [music] 2026. This is show number 1,111. But the numbers getting so long it's even after the music. Well, before we get started, I wanted to muse about a few tech and non- tech things about our recent adventures. As always on our bigger trips, I wrote daily emails as a travel log to around 130 people who voluntarily read my silliness. I have one final installment to write, but it's already over 10,000 words with lots of photos. When complete, I'll add it to the travel log page on podfeat.com, so you can read it if you want to. We started in Spain for the eclipse, and this was our fifth successful viewing, and it was even better than all the others. It was absolutely amazing. I highly encourage you if you ever have a chance to see a total eclipse, please take the opportunity. It's nothing like a partial eclipse. Well, I shouldn't say that. A lot of it's like it, but when it actually happens, it's life-changing. It's really an amazing experience. I guarantee you won't regret it as long as you don't have clouds. Now, from there, we went to Portugal, and this is where a little bit of the tech angle came into play. Remember the review I did of the Turbo Fan from Jizu Life? It's a very small battery operated handheld fan that's USBC chargeable. It's possible this fan actually saved my life. We ended up in 99 degrees of heat Fahrenheit that is while on a walking tour and I used the fan constantly to try to keep from collapsing. I put it on tables while we were eating and I handheld it the rest of the time. It never lost battery power even though I used it for the better part of every day while we were there. By far it was the best $12 I've ever spent on tech. Now, getting to see Bart in Ireland was just such a huge highlight of the trip for both of us. It'd been 16 years since we'd seen the him in real life. Steve and I spent three days together with him and his delightful husband, Wing. In the show notes, uh, for actually, yeah, you should be able to see it in the show notes is a picture of Bart holding up a sign that says, "Hi, No Solo Castway." So, he says, "Hi to you, too." Now, here's the funny tech angle. As you'll hear in this episode, we recorded a security bits from his home. While we're both obviously quite experienced at recording 5,000 miles apart, we have little to no experience recording with anyone in the same room. I've done it, but it was cluji as at best and it would have required carrying a bunch more equipment. So Bart and I recorded from his studio and it was surreal for me to get to see him from the other side of the camera. Just seeing him sitting at his desk is was it was just so weird, you know, because I'm used to looking at him at him just through this little camera hole. Now, I recorded sitting on the other side of the wall from him using his bedroom and Wink's microphone. Now, here's the really funny part. Bart said that my video was a bit delayed and the picture wasn't great, but he looked fine to me and the recording was fine as well. Halfway through the recording, I realized why it wasn't a better connection. Since we'd been in many hotels on shared Wi-Fi, I was still running tail scale with our Mac Mini as an exit node. That means my traffic was tunneling from his house to my house 5,000 mi away, turning around and exiting out of the Mac Mini at my home IP, then traveling 5,000 miles back to his computer. You know, sometimes I'm just a little too smart for my own good. Now, the good news is I did realize it partway through and I didn't change it while we were recording, which would have been disastrous probably. And uh we use Blip to move files between us. So Bart always sends me the file using Blip. Had I forgotten, that file would have traveled all the way to my house and all the way back to his house. Instead, it just jumped over the wall and came over in just a few seconds. Now, I'm not going to blather on any longer about my summer vacation, but I do want to give a heartfelt thanks to Alistister for staffing the ship while we were gone. I did end up being able to assemble the show as you heard, but he published all of the blog post, did the initial spam on Slack and Mastadon, and checked the feed to make sure it was error-free. It was filled with errors, so that was an important step. And he actually published the show. He also recorded a segment for the show and one for this week. Bart contributed to last week and to this week, too. And of course, the lovely Jill from the Northwoods and Eddie Tonkcoy contributed their articles as well. Without the kindness of my internet and real life friends, the show never would have happened. So, thank you, thank you, thank you. [music and bell] Bart here with another attempt at spending your money. So, I have been cycling for a long time, tracking my fitness, and the Apple Watch all by itself is actually a very capable cycling computer. But I've also expanded that as reviewed previously over the years here on the Nasiliccast with a dedicated heart rate sensor and a dedicated Bluetooth cadence sensor. So, both of those talk straight to the watch and they feed data into Apple Health. Um they're both from a company called Wahoo and they've been working great for me. Um and you know in terms of actually tracking my cycling both you know what it what the bike is doing what I'm doing at the time and what the bike is doing it works great but it has a very small screen stuck to my arm which is not the most convenient thing ever. Well, iOS 26 has actually solved that problem part of the way anyway because with the workouts app now does live activities with the watch. So when you start a workout on your watch, it will show up as a live activity on your iPhone. And if you tap into it to embig it, it will become a full screen display which if you're doing a cycling workout is basically a cycling computer. So you know you get a full screen realtime easy to read copy of your live metrics and everything is actually still being captured on my watch like it always was. So then the next problem becomes okay great the phone can do this but obviously can't cycle around with a phone in my hand looking at it. So, how do I somehow square that circle? And the answer is I have discovered for me anyway, the Peak Design universal mount system. So, I am very nervous about strapping a great big iPhone to my handlebars because, you know, the Irish roads aren't always great. What if it shakes loose, falls, and explodes? I don't really want to destroy my iPhone 17 Pro Max while out cycling, but I was eventually sort of inspired to dig a little deeper and I think I had bought something else from Peak Design and they they sent me a marketing email about their mounting system and I decided to watch their videos and oh, actually turns out that they have really good bike mounts and the video demo was really quite impressive. Um the the lady demonstrating how robust the thing is picked up the bike by the phone and lifted it up in line with her head. Now I have tried this since I installed it and um wow. Yeah, [laughter] it it can do that. Um so okay, great. So I bought them and I've been using them. I they actually have two models that work on the bike and um I've bought both of them and one of them on my my sort of my hybrid bike and one of them on my mountain bike just because different shaped handlebars and all in all it's actually been working great. So I've now had the luxury of cycling with my iPhone straight in front of me. And so the first thing I have in the screenshots is just a little note or in the show notes just a little note on what it's what it looks like to be cycling along with this live metric. So I have mine configured to show just three views. So the first view gives me sort of my current speed, average speed, active calories, and current heart rate. And then the other view gives me current heart rate, cadence, and speed and distance. And then the third view is the heart rate zone view, which helps me sort of time myself. I like to because I tend to do fairly long cycles, I like to keep myself in zone two, occasionally into zone three for a big hill, and inevitably also sometime sort of at the top of zone one. But, you know, it's really nice to see that in real time. And so, that's all stuck in all in the show notes there, as well as links to these two review videos that finally convinced me to dare to have my phone on my handlebars. So, in order for the the the Peak Design system is it's a universal mounting system, and it universally clicks into their cases. So, you have to buy well, you can also get an adapter to turn any case into a Peak Design compatible case. I didn't really want to go that route because what you're doing then is basically gluing a thing to the back of your case. And I was like, well, I want something unbelievably robust and I don't really trust glue. So, I bought myself a case. I went for the Nur case GNAR H. I bought it in bright orange to match my bright orange iPhone. Uh they call it Ibis H, but it's bright orange. And then I bought their Peak Design outfront bike mount V2 for the mountain bike. Um, that one has a hex screw for maximum security. So they have an offer to have it as not with the hex screw with like a a quick release or with the hex screw. I hex screwed it on. And then they have the universal bar mount uh which I use on the city bike. And that's actually removable. You just clip it on and clip it off with a very, very, very, very, very, very, very heavyduty, very, very thick elastic that holds on to that thing very tight. Takes a little bit of effort actually to put the elastic around your handlebar. Um, so the difference is the first one mounts off the handlebar and the second one mounts off the T- bar. So if you imagine a bike, you have the vertical riser, then you have a bar that goes forward and then you have the handlebar. Well, the universal one goes around that bar that points forward. Uh, so the phone is a little closer to you and my hybrid bike has a particularly long T- bar that's pretty much iPhone length, so it's kind of perfect. The mountain bike doesn't. So, um, I actually have, what I ended up doing is buying a handlebar extender because I my handlebars on my mountain bike are not flat. They're angled in all sorts of weird ways. And I already have lights and other things I need on the bike, a bell, important one. So, I ended up buying a bar extender to give me a little a second mini handlebar out in front of the main handlebar. Um, and then I could attach the Peak Design uh case to that handlebar in technically reverse order. So, pulled towards me instead of in front of me. And that puts it over the tea bar again, which is exactly where I want it. That's a really comfortable place. So, the the bar extender, by the way, is carbon fiber. I managed to find one on Amazon for a whopping €12.99 because there are a lot of steel ones, but you don't want to add weight to your bike. So, carbon fiber one, 20 cm long, which gives you lots of room to mount things um for €13. No bad deal. So, in the show notes, I have a picture of first the universal mount. Uh sorry, no, I had the first one I have is of the Yeah, sorry. The city bike. Actually, both of my bikes have weird shaped handlebars. I've just noticed looking at these photos. So the first one I also have the bar extender on to project my headlights ahead of the phone actually because the handlebars is just a weird shape. So the city bike again with curved handlebars with the two headlights on the extender bar but the phone is actually mounted to the T- bar and you can see it's just perfectly placed to look at. And then I also have it with just the case. The phone clips in and out of the case really easy. So I don't keep my phone in the NR case all the time. I actually keep it in the Apple sling case that you throw over your shoulder and but it clips in and out of that one easy too. So, I just flip the phone from one case to another and when I'm just at home during the day, the phone is actually just bare because it doesn't need any case. Um, so I don't mind I don't feel I have to have one case that keep all the time. I just flip the phone in and out of whatever case. And so when I need to go cycling, I pop the phone into the Peak Design case, very rugged, very robust, and then it just clips. And it it clips so pleasingly into those universal mounts. It just zero effort. Just goes click. It just homes itself. And while it's unbelievably sturdy, you can release it with just a single finger and it just pops straight off. It's very well engineered as I'm discovering all the Peak Design products are. So the three first pictures in the show notes are of the city bike with the universal mount on the T- bar, then the case on the T- bar, and finally just the bare mount as it exists. And sort of to I also have a widescreen view of my full handlebar because I'm quite a diligent cyclist. So my handlebar is a busy busy place. So, I have my wing mirror, I have my bell, I have my two headlights, I have the peak design, I have the my bullbars because I like to be able to have my hands vertical instead of, you know, facing at 90°. So, where handlebars go. And then below that, we have the other one on the mountain bike. So, again, the handlebar extender, but this time instead of the case being strapped to the tea bar, it's strapped to that extender and pulled back towards so you can see the bare mount. the zoomed out view. Um, and like I say, I've now been using this for months. I have used it on gravel paths. I've used it on rough roads that are in the middle of road works that were spectacularly uncomfortable to cycle on. At no point in time has either of the two holders ever come within a within an within the tiniest of within any sort of a margin of losing the phone, of anything ever happening. It might jiggle a bit when the whole bike is jiggling. Well, well, the whole bike is jiggling, but it's never ever ever in any danger of coming off. And the universal mount, even though it's mounted with quote unquote just some very very heavyduty elastic, it is rock solid. No matter what I have done, the phone doesn't doesn't move. It doesn't come out of alignment. I line it up, it's perfect, and it's just been sitting there for months and months and months, constant use. Yeah, these really are like the the demo video is impressive. I've now been using it for months. The demo video is fair and accurate. It really does work as well as the videos show. So, that is kind of cool. Um, just a little bonus. Um, something that you may not realize in all of these screenshots of my handlebars, there is an air tag in so quote unquote plain sight. Can you spot it? Bet you can't because the air tag is hiding at the bottom of the bike bell. So, the bike bell has its usual bell and then there's a little black rim of plastic that looks like it's just there to hold the bell, but that screws off and in there is an air tag. And so, both my bikes have these air tags in the bells. So, that's how I hide the air tag. And I'm pretty confident that if someone steals the bike, they're not going to notice that air tag hiding in there too quickly, at least, you know, in time for me to figure out where this where the boogering people are. So, you know, fingers crossed. It also wasn't expensive. That little bell with It's also a good bell, by the way. Uh cuz it is kind of important. I want a bell with a friendly but loud tone. Uh cuz I don't want it to sound like I'm shouting out of my way. I wanted to shout like a swing. Hey, heads up. I'm here. So, right now, that bell is called the triple E kit bell bike for hidden air tag holder anti- theft bicycle bell with the loud sound fits 21 24 millimeter bike handlebars because that's how you do things on Amazon. Um, it's a whopping 16.38 right now. Link in the show notes. So, like I say, having been utterly and completely skeptical about the concept of having handlebar mounted phones for absolute terror of losing my phone horribly. Turns out that Peak Design have genuinely designed great products that work reliably and will give you the sense of comfort you need to entrust them with your precious phone. I got to say it was so cool to actually see that bike mount in real life. You're going to hear a story and a little bit of how that happened. Okay, enough goofing around here. Let's listen to Alistister Jenx. [bell] I've been a user of reinvented softwares keep it for over 7 years. According to the product page, KeepIt is used to create and edit notes, rich text, plain text and markdown files, scan documents, edit PDFs, archive emails, save web links in a variety of formats, preview and search just about any kind of file, and organize these in a variety of ways. I don't use it much for notes, but I do use it to keep track of receipts, contracts, policy documents, authorization forms, and more. I love that I can quickly scan a paper document directly into Keep It using my iPhone, and I can then access it on the phone or a Mac or iPad as it stores files in iCloud. Likewise, I can also add electronically delivered documents directly using its share sheet service. It has been handy when calling up a receipt in a shop or itinerary in an airport or an accident form in a medical center. More recently, I've been using it to capture many photos, scans, and some web pages that I've been gathering in my personal history research. In this use case, it has never felt quite right, but I never put my finger on why. Sometime in April, I launched the app on my Mac, and presumably as a result of a software update, I was presented with a pop-up window introducing me to a new sibling app called Scrappy. I decided I should learn more. At first, they seem quite similar, but they really have different personalities. Keep it is more like a serious filing cabinet for documents and notes. While Scrappy is built for quickly grabbing snippets, links, images, and ideas from around the web. Keep it is file-based. Its contents are all files that live in normal folders, and it integrates tightly with Finder and iCloud, so it acts like part of the operating system. It also has powerful editing and organization tools, including markdown support, OCR scanning, mail archiving, and automation features. Scrappy keeps things simpler and more visual, abstracting away folders and file names, and has a stronger focus on browsing and collecting. The difference shows with web links and notes. Scrappy acts a bit like a smart scrapbook, automatically pulling in previews, images, and article text. Keep it takes a more traditional approach, saving whole pages as PDFs, archives, or editable documents. Keep its notes are also much more featurerich, almost like a lightweight word processor. To choose between them mostly comes down to workflow. If you want a structured, long-term archive for documents, Keep It is the heavyweight option. If you want a fast, flexible place to throw interesting things and find them later, Scrappy is probably the more approachable app. You can read more detail about the differences on the reinvented software site. Link in the show notes. I decided to try out the trial of Scrappy and see if it better suited my personal research tasks. I used a migration tool to take the content from Keep It into Scrappy. This was less than ideal because I had to take all the content. So, I ended up keeping my personal history section and deleting a lot of other things. This was easy to do, but the iCloud syncing took a long time to catch up with it on every device. As everything in Keep It is just a file and that file is right there in Finder, I could have just dragged them all in, but I wanted to allow the two apps to share any metadata. Once I got the basic content across, I started figuring out how the organization works. The first thing to note is that instead of folders, Scrappy has lists or not, because Scrappy is based on the concept of a library and does not expose files. Your items just exist in the library. The primary means of organization is lists. These are like folders except items can be in more than one list or in no lists at all. In this sense, they are like labels or tags except scrappy also has tags. These are optional and items can have zero or more of them. The difference is in how these two are represented in the interface. Lists appear in the sidebar, can have a hierarchy, and there are also smart lists. Tags are just tags. Each exists on its own. Of course, smart lists can query tags along with numerous other attributes, including list membership. My keep files had been imported from folders into lists with the same names. As I started trying to improve on my organization, I went through a few iterations. With the help of a few email conversations with Steve at Reinvented Software, I finally settled on a structure that is now working pretty well for me. It is worth noting here that every item has a name, but because they are not files, you can have multiple items with the same name, even in the same list. It's probably more useful to think of them as titles. I have almost no standard lists. Instead, I have leaned heavily on tags. I have a group of tags, each for people, places, and item types. These groupings are only related by color. Each tag can optionally have one of the standard seven colors like finder tags. I then apply all the relevant tags to each item. For instance, I have a scan of a paper blessing we were given at a temple on our tour of Japan. It has labels for Japan, momento, and for me and my wife. I have a series of smart lists, one for each person, place, and item type. These lists mean I can quickly go to say everything from Japan or every momento. Initially I was trying to do this with standard lists but the real power of tags comes from the search box. If I start from one of my smart lists then that initially limits my search but I can also start from the all items view. A quick aside the all items view is critical considering items can exist with no list membership and no tags. Whether I have an initial filter from a smart list or not, I can click in the search box and start typing. Typing a letter J gives me quite a few possibilities. JPEG images, Japan, and every person on my tags list because I'm using initials and we all have a surname starting with J. A click on Japan or using the arrow keys to navigate to it and press enter will add it to the search box. And the main view is filtered to only matching items. Now I get to just keep typing. The letter M gets me quite a few item types, but by the time I get to MEM, the only option is momento. A down arrow and enter locks that in. Now I'm looking at all Momentos from Japan. I could keep going if I wanted to select on a person as well. This is equally easy on the Mac version or in an iPhone or iPad. Once you find your items, they're easy to consume. Everything in Scrappy is displayed as a large square thumbnail. A double click or tap opens it to take up the full size of the main view. The escape key will close it again. In the case of saved web pages, there are two views available. The link view shows a simplified view much like Safari's reader view. This is also the view that the thumbnail is built from. The page view loads the full web page. In this view, there is also a button to save the page into Scrappy's library so you can access it offline. If you already have it saved, you can click the button, then confirm, and Scrappy will remove the saved page. With any item open or even just selected in the main view, you can use the standard share button to share the item. Web pages share a URL and images and PDFs will share as their original file type. There are many other small features I won't cover, but they allow you to navigate and organize in yet more ways. Scrappy has a 14-day free trial from the app stores, after which it is a subscription for Mac only, $19.99 per year. iPhone and iPad only $14.99 per year, or combined Mac and iPhone and iPad for $29.99 per year. It has survived a recent review of my subscription outgoings along with Keep It and is finding an increasing use case for me. My latest use is capturing web pages for some product research for a large upcoming purchase. I still have more work to do, adding more tags to my personal history items, too. I love this because I took a look at Scrappy as well, and I'm a big Keep It user from Reinvented Software. I love the app. use it all the time, but I couldn't see what scrap he was for. And now he's got me thinking. I think I might need to go check that out. Shortly before we went on our trip, the lovely Alan Zean became our newest patron of the Podfeat podcast. People like Alan are the lifeblood of keeping the show financially viable to create. Alan and the other heroes went to podfeat.com/patreon and chose an amount that was right for them to show the value they see in the content produced here. It's easy and you could even donate as little as a dollar a month if you want to. Alan, I salute you and your support. [music] Well, it's that time of the week again. It's time for security bits with Bart Boo Shots. And Bart and I just got back from a lovely walk along the canal because I'm in May. Yeah. So, we're sitting what? Three feet apart, but there's a wall between us because we don't know how to record in one room. >> Yeah. Yeah. Well, and and I can actually hear you through the wall a little bit. So, hopefully the mic isolation is better than if we were sitting We debated doing it in the kitchen, sitting across from each other, which would have fun comedy, but it's actually acoustically not as good for for doing that, I think. Right. >> Also, I have no idea how to set that up. I know how to do this because I've been doing this for 20 years. Yeah. To know how to do anything else. >> I know. When Dr. Gary comes to the house, she she makes me do it in the same room with her and I'm like, "Oh, it's so hard. It requires my Zoom H6 and oh, it's a big pain. It's very, very hard. But, uh, >> we have been having an absolute blast here. It's been it's been great fun. It's it's so nice to have you just like I randomly bumped into you on Main Street yesterday. That's so cool." >> Yeah. Steve and I were going to a a local pub and Bart rode up on his bicycle and actually I got to tell the story. So >> every day at at noon when Steve and I are eating lunch, both of us will lift our wrist because we got a notification at the same time and it's because Bart finished a workout and we were standing on the side of the street in in Dublin or in May when he rides up on his bike finishing that same bike ride. >> Yeah. >> It's like it was the same time that we look at our watches. The whole thing is just It's surreal. >> Yes. >> And it's over tomorrow already. >> I know. It feels like only yesterday that I picked you guys up. It's Yeah. It's been so great, haven't you? >> It's been so fun. >> All right. Well, we should probably talk grim misery and what's going on in the world of of security, huh? >> Well, there is some grim news, but it is a mix and I do try to end happy. So, you know, bit bit of everything. So, some follow-ups on things we've talked about before. um a nice bit of deja vu from the UK. So about this time last year, we found out from the Financial Times that Apple was being demanded by the UK government that they decrypt iCloud in a super secret court and the law makes it illegal for Apple to even admit this is happening. Well, there's a new report from the Financial Times saying that Apple have filed against the government in the super secret court challenging new orders that they decrypt iCloud. So, like last time, officially, we know nothing, but it's almost certainly as true as it was last time, sadly. So, is this they've come out with new rules to try to do it that they failed at last time, or is this just more churning on the first one? Well, we can't really tell because it's all super secret, but the the law hasn't changed, but the government can just make new demands under the law, and we can't know what they're asking. Cool. Cool. Yeah. So, anyway, Apple are challenging something. I hope they win. [laughter] Okay. So, I think it was LG two weeks ago who were embarrassed into making a new rule for their TV app store to say that you couldn't have those horrible residential proxy apps. And I think we said that the other big player was Samsung and that we hoped they would follow suit. They have >> so. >> Okay, good. So, we need Sony and then we've got most of the trifecta of the biggest ones, I think. >> Yeah. I'm not sure if Sony will run on the naughty step. I know that LG and Samsung were on the naughty step. So, I think we may be okay. Well, >> I would still not use apps on the telly and use apps from people who do software, >> not hardware people. >> Yeah. >> Anyway, >> yeah. >> Well, apples are hardware people. >> True. Um, [laughter] something we have talked about quite a bit is this whole age verification thing. And one of the things I like about Apple Wallet supporting government IDs is that it is a privacy protecting way of asserting that you are above a certain age. And the more states that get this, the better is my opinion. And I'm happy to say that if you live in North Carolina, early 2027, you too will be able to add your state ID into your Apple Wallet. >> So, >> excellent. Yeah, and the good folk at Mac Observer have done a list of everyone, every state that has it announced but not yet delivered. So, there's actually seven states where it's a work in progress. So, if I can get my shortcuts right, I'm going to see if I remember your twoletter abbreviations. KY is Kentucky, C is North Carolina, OK is Oklahoma, UT is Utah, VA. >> Yeah. CT Connecticut MS Mississippi. >> Very good. >> Oh, could be Missouri. I don't know. No, Missouri's MO, I think. So, MS I think is Mississippi. >> Well, the people who live there are now shouting at their iPods and they know who they are. [laughter] >> At their iPods. Aren't you cute? I can't believe you know the acronyms for our state. So, okay. [laughter] Two letter digits. Probably not acronyms. >> Yeah. What? Yeah, they're abbreviations, I guess. Codes. guess are codes. >> Yeah. Yeah. >> We have nothing explicitly submitted by listeners, but I am going to remind you all that if you have a question, pop into the Slack at podfey.com/slack and find the security bits channel and post away. >> There you go. We take questions now. It's all new. So, we actually have two deep dives. So the the first deep dive is kind of like a follow-up, but it's a little too much to put in a bullet point at the top of the show. So two weeks ago, we had our big discussion about AI agents breaking out of their cages or their sandboxes. >> Yeah. >> And we did say [clears throat] the industry were busy reviewing all of their logs and I was pretty sure there were more shoes to drop. Yeah, there have been. So we have two significant pieces of news if I remember rightly. So the first one I find the most interesting. So the UK government have an institute whose job it is to test AI and based on what I've been hearing from experts they're actually considered to be worldleading in this as an institute who's actually doing useful testing. So they're called the AI security institute. So they named they're named for what they do or AI AIS is what they're abbreviated as. I'm not sure if you pronounce that but AI. Yeah, let's say AIS. So they were testing Claude Mythos 5 and they set the model a simulated hacking challenge and during the test the model took quote unsanctioned actions on the real internet. Now there was no harm done but the testers were very disconcerted by the fact that this happened and in fact I'll quote from their report. This is the first time we have seen risks around autonomy and deception manifest this clearly. Deception. >> Wow. So that's way beyond that's interesting. It's a whole another level. >> Yeah. And these are, you know, scientisty bureaucrats. They don't talk in flowery language. This is like them with their hair on fire. This This is >> Yeah. Yeah. That's a great sentence though, >> isn't it? [laughter] >> So, before we go into a little summary of what the model did, it is worth noting that some of the safeguards were turned off because that's the point of this testing. what happens when the guardrails come down. So, they're not quite like they are when the public used them, but nonetheless, they did not expect by taking the guard rails down that they would show these deceptive behaviors. So, they expected them to accept orders they should say no to. They did not expect them to become deceptive, to become intentional liars. Um, >> so the so if the the AI had said, "Hey, you know, I can see this thing out there. I'm going to go out there. Is that okay?" Instead, it's just going, "No, I I didn't do that. I'm not I'm not going out there. I won't use that." >> It's way worse. >> Oh, no. Is it? Oh jeez. >> Okay. >> Rather than me trying to summarize a report I haven't read. I'm going to read from Bleeping Computers summary of the report I haven't read. Um, and >> because they read it. >> Because they did read it. Yes. So the agent then attempted a supply chain attack by submitting malicious code to the real open-source project believing that compromised the software could provide a path into a machine within the simulated environment. Most concerning, the agent researched the project's maintainers, created multiple fake GitHub identities, and used those accounts in social engineering attacks to push the maintainer into approving a malicious pull request. When a human reviewer warned that the pull request contained malware, the agent denied the accusation and used another fake account it controlled to pressure the maintainer and create the appearance that independent users had reviewed and approved the changes. That's deception. >> Wow. And >> so why was it why was it going after this particular open source project? because the software involved was in the simulated environment. So they were asked to hack a sim as a you know a fake server which was running real software obviously including a product hosted on GitHub. >> So they went and attacked the GitHub repository so that they could force m >> into the project. Yeah. >> Okay. and and and they're what they were asked to do was to break the simulated one to hack into a server. They were just asked to hack into a server. >> Hack into a server. >> So they found it was running some app. We don't have all the details here. So they let's say they found it was running Apache. >> I'm I'm making up Apache. And their answer was okay, we'll write some we'll write a buggy version of Apache and we'll do a pull request and we'll trick the maintainer into accepting it and then we'll have a back door. Okay. And so as well as creating lots of fake GitHub identities, doing a social engineering attack, creating more identities to act as fake second opinions, they also did all of this through tour. >> Okay. So hiding what they were doing. But how did they expect it to hack the server? I mean, isn't that the way people hack servers is do evil things like this? Well, it's one of the ways you can get into a server. If you can't find a bug, make a bug, >> right? I mean, they did ask them to do this, but they asked them to hack a server. They didn't ask them to start lying in social engineering. It's the lying and the social engineering that has terrified. >> It's the fact that when they were found out, >> it's thinking that up. >> Yeah. Well, not just trying in once, but when they were found out, they made extra identities to lie to back up the story of the first identities. >> Yeah, >> that's pretty deceptive. >> Okay. Wow. >> Yeah. Like I said, this is not what they were expecting to happen. So, there we go. The second story is a bit less dramatic. Open AAI also suffered another escape. Um, but this one is literally a footnote in the bleeping computer story that described the attack above in great detail. So, GPT5 Saul was being tested by an independent lab called Irregular in a particular type of hacking game called Capture the Flag. It's basically >> Mhm. >> Yes. The digital version of that game where you hide a flag somewhere. In this case, the flag is a particular web page you have to deface or something like that. And >> okay, >> as is always the case with a CTF, capture the flag, they were in a sandboxed environment, but they managed to break out of the sandbox again. Um, in this case, they they did something I find fascinating. So, do you remember one of the very first times we talked about LLMs? We both loved that you could ask them questions that were really vague and because they're pattern matchers, they could they could answer things. I I remember I was trying to remember the TV show about the drug company that was doing evil things and the main character was played by the guy who played Batman. And I asked Lumo basically that and Lumo went, "Oh, you mean dopsick?" >> And it was what I meant. >> Right. Well, that's what's great about how you can be vague. >> Yeah. They were in a simulated situation with a fake server and a fake company. So, a whole scenario. There was a real website with a similar name and the LLM did its pattern matching thing and decided the real website must be part of the simulation because its name was close enough to the fake company. >> Oh, no. >> And they tried. This wasn't malicious. This wasn't Well, this wasn't uh >> it was just wrong. >> Yeah. But in a very LLM like way. So again, the dangers with these LLMs is not just that they might do things we don't expect. >> We also know they're not 100% accurate. >> Like here. >> Yeah. Yeah. And so not to be outdone, Meta also lost control of a model. They're being very circumspect in what they're telling us. They do promise they'll have a full report later. For now, they have said a model. The entire industry is convinced it's Spark 1.1, but that's assumption. >> Wh why what is Spark 1.1? I haven't heard of that one. Is that one of theirs? >> It's one of Meta's newest models. Okay, so they're not sharing much information. The only thing we know is that their model attacked a realworld organization, but they won't even tell us which one. They won't even tell us how they attacked, >> whether or not they got in. So the full total of what we know is exploited a security vulnerability in a third-party service in a manner similar to previously reported instances with other companies. So we did a thing like those guys and we're not going to tell you anything. Okay. >> Yeah. That's this is too important to be messing around with keeping things secret. >> Agreed. the other companies are at least doing a good job on that. >> Yeah. Now we do have some other news that is a little less some of it's a little less depressing. So I had said that I did actually think some people in the industry were taking note evidence that at least some people are open AI have announced that they are slowing development of their models because they're concerned about the cyber capabilities. So they're they're not increasing the scale of things. So they're not the you think with scale they were not increasing. >> So it's not going to get any worse than the terrifying thing that it is right now. >> Yes. And the important thing right now, so right now these models are really good at finding bugs. And these models are running in sandboxes that are written in software. What we need now is a pause for these models to find and fix the bugs in the sandboxes before we start using the sandboxes anymore. What do you mean using the sandboxes? >> Well, so we've been assuming the sandboxes work, but the sandboxes are clearly riddled with bugs because these LLMs keep finding the bugs to get out. >> So, we actually need to use their ability to find bugs >> to find the bugs in the sandbox, >> point them at the sandbox itself. >> Yeah. >> Well, not exploit the bugs, find them and fix them. >> Yeah. Exactly. So the you know the way you can they're actually very good at finding bugs and suggesting fixes. So I think they need to do what Firefox and Chrome have been doing >> and finding these hundreds and hundreds of bugs. >> So you know it can bootstrap itself a bit. >> And just in case you were thinking of dipping your toes into this whole agent thing, they've discovered yet another way that your agents can be corrupted. It's a new kind of attack that they're calling a mind virus uh because it can spread between agents. So the the thing to do these days is to have multiple agents working together as a team and those agents have to remember what they were doing before and LLMs don't have a memory and they have to share memory with other agents. So the way they do that is by all of them writing a markdown file. And if you manage to trick one of the agents to put prompt injection into the shared knowledge, that stays there and they all get it. So it spreads like a virus. >> Cool. Cool. >> Yeah. >> Cool. Cool. >> Yeah. >> I'm going to go stick my head in the sand while you finish, Bart. [laughter] This is Oh no. Get your head. You you want to be around for this bit because deep dive number two comes from you. >> Oh, okay. My fault. My bad. >> No, it's good. This one counts as good news. Remember, I always do the pressing stuff first and then we go uphill from there. >> So, we talked two weeks ago about the new law that came into effect in Europe because that was making all of the headlines in my RSS reader. >> But the same day, a California law also came into effect. But for some reason it didn't make my news headlines. Maybe it's because on paper the EU law is a multinational thing and the California law is a law within one state within one nation. But >> just that little 12% of the the world's economy test state. >> Exactly. California is not like other states. We have a decade's worth of history of Californian regulations kind of being deacto American regulations. >> A lot of times it follows. Yeah. >> Yeah. Well, also if you're going to make say a car that has too many emissions for California, well, that's too big a market to lose. So you just make the car better for everyone. >> I think so. Yeah. >> Yeah. So I think the same logic applies here. Anyway, this act is very well named. It's California's AI Transparency Act and it addresses exactly the same problem as the European law. It's not about stopping the AI agents doing things, but about human beings being able to tell the difference between real world capture and generated content. And neither is better or worse, but you do kind of need to know which is which. Right. Right. So, for so this law is coming into effect in pieces. So one piece of it came into effect on the 1st of August 2026 and that's already useful but I read ahead because you found some really cool analysis from local law firms which is great because yeah that's who should care. So the Silicon Valley law firms are telling the Silicon Valley companies what to do and you found great links so they're in the show notes. Well, that's funny you say that because one of the when Bart and I were talking about it, I was looking for, you know, a Verge article or, you know, one of one of the classic places that Bart looks and I couldn't find any, but I found lawyers offices doing it instead. >> Yeah. >> And I I felt kind of like, well, I guess I can't support that this is a big deal if it's not on the verge, but >> I, you know, for a law, maybe lawyers are a better source than the verge. [laughter] There you go. >> Okay. So what what is it? >> Okay, so it's in two parts. So I will explain both parts but the first part is now and the second part is 2028. And the part now I like and the part in 2028 I adore. So from now every large AI vendor is what the law talks about and the definition of large is at least 1 million customers. So we're talking about the anthropics, the open AIs, the the big players. Sure. >> Okay. >> These vendors need to start embedding provenence metadata. So, provenence is a term that predates computers. It actually comes from the antiques and collectibles industry. So, >> the provenence of say a Babe Ruth baseball card is the full provable history of that card's existence. Because the only way to know if you have a real card, not a fake, is to be able to go back in time all the way to the card's origin. And that chain of evidence is called the provenence. And so when you auction something off in Christies or one of these big auction houses, they ask you for provenence, they verify the provenence, and then they list it. And so a good provenence means lots of evidence. A bad provenence means terrible evidence. But digitally, you can have provenence that isn't good or bad, but it's cryptographically provable. So you can use digital signatures to create a chain of changes. So you you make the photo and you digitally sign it. And then you edit the photo and you digitally sign the edit. And you keep doing that to make it chain. And then you can say cryptographically, provably this photo was shot on the 4th of June. Then it was edited in Photoshop where they raised the shadows and cropped it a bit and then someone put it into an LLM and completely changed it and now it's something else. Right. That is provenence. Maybe >> this your description sounds kind of like the way um cryptocurrency works. Yes. The blockchain and that's the providence you're talking about. >> Yeah. So the blockchain is providence of a different kind. It's not it. It's basically who's which wallet is this money in? But it's a chain. >> Right. Right. >> Yeah. So here's the chain of edits, >> but the cryptography is the same. Yeah. >> So, >> okay. So, as of right now, they have to embed Providence metadata into generated content. >> Yes. Now, the thing about provenence metadata and all cryptography, it's like a digital signature. It is impossible to fake. So if there is provenence metadata, you can use the various hashes and the public keys and stuff to prove the provenence is real. So you can't fake provenence. But like you can go into an MP3 file and delete the ID3 tags or like you can go into a JPEG and delete the various uh what are those metadata called again? >> XF data. >> Thank you. It fell out of my brain. You can just delete the provenence metadata. So an absence of provenence proves nothing. >> But the precedence of provenence is genuinely meaningful. >> So okay, >> having the provenence put in by the big AI companies is already nice because it gets rid of all the lowhanging fakes, right? The fakes made by someone in 2 seconds on chat GBT. They'll just have the metadata easy to detect. But it won't stop the truly malicious people. And it kind of never can because I don't think detecting AI is the wrong question. What we actually care about is proving quote unquote real as in proving images that were taken from the real world. And that's where 2028 comes into the picture there from 2020. >> Can I can I pause you first though, >> please? >> Before you get that far, it's been occurring to me that um you were talking about Providence being in Photoshop. They brought up the levels or whatever. Photoshop, Adobe has more than a million customers and they have AI built into their tools. >> They do. >> So, they are an AI company, more than a million customers. And Apple has AI built into its photos tools, too. >> Correct. >> AI is in there and they've got a more than a million customers. So, this applies to them. So, if I take a photo of you down at the canal and I I realize I didn't I didn't crop it quite the way I wanted to and I extend that image using uh AI and photos that would need to have providence data. >> Yes, they would meet that requirement, I would think. Well, so they have a grace period. So, okay, so there's an extra complication. If you're a new company, it applies immediately. The existing companies have a grace period to implement, but they're busy implementing. And I don't have a link in the show. Oh no, I do have a link. Okay, put a pin in that. I'll come back to Apple because I have good news. Uh, >> okay. >> So, in 2028, this is the bit that makes me genuinely excited. To use the laws language, capture devices will have to add providence metadata cameras. >> Okay, >> we will have provably real images from 2028. Nice. So there is a standard that So the law doesn't name a specific protocol. The law just says industry recognized standard or some vague wording. There's only one. There's only one. There's only one player in this game. And all of the law firms just say, "Yeah, the law doesn't say C2PA, but there only is C2PA, so the law means C2PA." And this >> I have no idea what C2PA is. >> This is an open standard developed by the industry with really big players like uh Adobe, Microsoft, Google. It's it's like the PHO alliance. It's a a nonprofit organization paid for by the industry full of experts and they all agree these things. And >> but what is it? >> C2 I don't it is a provenence me is a provenence standard. It is a standard for it's like XF for provenence. >> Okay. So, this has nothing to do with uh uh any of these companies making this up now or this law. This is something that already existed. >> So, C2PA exists and it can do provenence. The law now says you must do provenence with an industry standard. Well, that means the law now says you must use C2PA because that is the industry standard. >> Okay, >> this is where the news starts to get really good. Adobe have been in involved in C2PA from day one. Photoshop has supported C2PA for about 5 years now. So, every Photoshop edit can be part of one of these chains. So, it's probably not in there yet. >> No, it is. I checked. It's turned on on my Photoshop and has been So, I thought you just said um they this didn't exist. Providence C2PA existed, but Providence was not part of it. >> No, no. Provenence. >> It just wasn't required. It was just an optional thing that existed. >> Gotcha. Okay. I I now it's ringing a bell. Adobe working on this. I think I remember you talking about that a while back. >> I was because I dedicated an entire let's talk app or let's talk photography to explaining it. Uh which I will link. >> That's where I figured. >> Yeah, I will link that in a minute. So, Apple have a feature in the beta of iOS 27 or 28. That's interesting. Maybe it's in 27.1. No, I apologize. It's in the beta of the iOS 27 that's going to start enabling C2PA on our iPhone cameras. >> So, >> oh, cool. >> You need to have a chain from birth to publishing. If iPhones start doing C2PA and Apple Photos app does C2PA and Photoshop and Lightroom do C2PA, that's a lot of photos covered from birth to publishing. Android's got to be in there too somewhere. They've got to be doing something. >> But Google are one of the partners. So, I'm sure there's another news story somewhere that there's a beta version of Android somewhere with all this kind of stuff, too. >> And but then you've really got is it is it Samsung that would be the big player, the million-dollar player? Well, I guess whether they're a million-dollar player or not, I don't know. >> Yeah. So that that's why the 2028 law or part of the law is so important because right now the the hardware people are allowed to start doing this. The standards here there's no reason they can't but they're not forced to but from 2028 if you sell a camera in California it has to support provenence. >> That's a big deal. >> Okay. Yeah. Yeah. So I'm I'm very excited. All right. Well, so especially important since so much of many of these companies are actually based in California. This is going to exist for everybody, right? I mean, obviously Apple and uh and Google and uh is open open AI in California, too? >> I don't know if they're there. They have Californians as paying customers. So, >> well, they they smell like tech bros. [laughter] >> They do rather >> from California, right? >> They do rather. Yeah. Yeah. So, I think this is a genu I think this is a bigger deal than the European law, which makes me extra cranky that the that none of our usual sources are talking about this. And I thought, have I just picked have I been using terrible news sites all along? No, it's just the tech media snoozed clean through this. It did not register for its importance. >> Huh. So, there we go. That is that is very odd. Well, it was covered here. It was so as well as So, yeah. Okay. So, the link section of the show notes has the links to those analyses that we've mentioned from the lawyers and they're they're quite good actually. They're very readable. Certainly, the opening few paragraphs give you what you want. Very human friendly. In let's talk photography 125. That is 30 months ago. I did a deep dive into how C2PA works. So that that's kind of the >> that's that's where I knew it. That's where I knew it cuz I don't I never miss an episode and that was it. Yeah, it was obviously it was hard explaining it. Guys, do you think it was great? It's great. You should go listen to it. >> It's a propeller beanie. Let's talk photography, but it's still Let's talk photography. So it was nowhere near as propeller beanie as we get sometimes in programming myself. [laughter] And then the most recent let's talk photography so 155 is me talking about this at a much more philosophical level. Not how provenence works but why it's important and why I am I think it's so important to stop trying to invent a magical AI detector machine. >> That is literally the wrong question. Mhm. What we need to do is demand our media prove it is real. >> Not us try to figure out how we prove it's fake. It shouldn't be on us to prove something is a fake. It should be on the people trying to convince us something happened to prove it's real. And C2PA is the tool that makes that possible. And this is coming. And that's why I'm so excited. Fantastic. Fantastic. This is This is more of a um pallet cleanser, but I can't give a link to it. Excuse me. Steve just showed me something on some social media somewhere. Uh it was a a picture and it said how to spot an AI fake. And it was a guy sitting on a train and he had a laptop open and there were red circles around everything you should look at. It was a red circle around the Apple logo, around some signpost outside the window, something on the guy's drink. And so your brain focuses on the red circles. The guy had feet for hands. [laughter] >> It's really funny because you don't see it at first because you're going, "Wait a minute. What's wrong with the Apple logo? What's wrong with that signpost? What is that?" >> That's like that gorilla thing where you've been told to concentrate on the basketball players and you don't know it's the joint gorilla. >> Oh. Oh, yeah. Dr. Gary messed us up with that one. Yeah, >> if you want a second opinion on all of this, Ezra Klene on his long form podcast has a fantastic discussion about this. Again, it's the Ezra Klein show, so it's an hour-ong in-depth thoughtful conversation, not five minute bang bang bang bang bang. So, make time for a detailed discussion or accept my summary. [laughter] Cool. Right. Well, that is our deep dives done. So, this is the other scary bit, Allison. The action alerts. All of the patchy patchy patching to be done. >> So, it has been [clears throat] patch Tuesday. We are living in the days of AI. There are 400 flaws fixed by Microsoft in patch Tuesday. Three of those are zero days. So, if it has a Microsoft logo, make sure it's patched. >> Okay. Yeah. Well, and that's that's your AI at work right there. Probably finding 400 flaws. >> Absolutely. This is technical debt being paid down. We are going to have to go through this for a couple of months and then it will settle down and we will all be better for it. So, this is not bad news. >> Yeah. This is the good news section. Yeah. >> Yeah. Yeah. We just have some work to do. If you have an Apple logo on a thing, you also have some work to do. Most importantly, um there are a bunch of fixes that are actually part of iOS 27 or whatever that Apple have backported into iOS 20 or into Mac OS, iPad OS, and iOS 26. So, normally they give us the updates to the old operating systems when they release the new ones. They're now starting to backport the fixes even before the new ones are out because AI is so quick at reverse engineering fixes. >> So if it's in the beta, they have to fix it in the real OS. >> Oh, that's really interesting. Yeah. >> Well, again, it's good for us. We get more bug fixes more quickly. Um, >> sure. >> Now, Mac users, don't doawawdle on patching. Apple fixed a bug in screen sharing, which means that if you have screen sharing enabled, someone can take over your Mac silently over the network. >> So, they patched it all the way back to Soma. If you have a Mac, make sure it's patched. >> So, you the the show notes uh from Tidbits says Taho, Seoia, and Sonoma. Is it just those three? So, it's Oh, wait. Taho is what we're on, isn't it? >> Yeah. not beta. >> Okay, [laughter] I'm getting lost on the numbers and names now. Okay. Uh so yeah, on everything. >> Yeah, >> good. >> Uh there's also some fixes for Safari 22 bugs. Again, Apple update Safari for the old OSs. Uh for Tahoe, the update to Safari is part of Tahoe. It's a bit weird how they do that, but that's how they work. M >> and definitely in related news um Apple have put a uh quot on how many bugs each uh security reacher searcher can submit each month because they're getting overwhelmed. >> Wow. >> Yeah. >> Now the title from Apple Insider says AI slop security reports. >> But that's the problem. The volume is coming from people sitting at home running the agent themselves and finding something that may not even be real and going, "Oh my god, I found a bug. I must report it to Apple." Those lowhanging fruit, a bunch of them are hallucinations. >> And those that aren't have almost certainly already been found by Apple and the other security researchers and are already being worked on. So being told 5,000 times about the same thing that may or may not be real. >> It's causing stress within the industry everywhere, not just in Apple. >> I bet. Yeah. >> Apple's answer is, "Okay, fine then. A quota. If you if you found something really important, report that to us and you get to have x amount of them a month, but don't flood us with everything else." If you are in America or Europe primarily and you have a home router that was sort of an unbranded one you've never really thought about. It probably wasn't very expensive. Check if its logo says ZBT link. That is a Chinese manufacturer who sell affordable routters to the US and Europe. They have a really nasty vulnerability that allows your router to be taken over. There is no patch. Not only is there no patch, the company isn't even responding to the security researchers. So, there's not even a promise of a patch. They've just got their fingers in their ears going la. >> So, replace routter. If it can run open WRT, I guess you could do that, but you can't keep using it the way it is now. >> And a hat tip to listener Yoop in the uh Slack for actually he sent it to me over uh Mastadon, but either way, Yep. still rocks, so it doesn't doesn't matter which medium he was using. Uh he flagged this one to me as well as a few other sites and stuff, but it was it's always good to get a confirmation. Uh, Yope actually had a nice link to vulcheck.com for a nice summary of what the problem is. You can go to zbtlink.com right now and buy one of these routers, Bart or not. [laughter] >> Yike yikes yikes. Okay, I like the name of the uh the vulnerability. Uh, wait, I lost it. Endless doors. >> Yeah, it's just black doors. >> That just gives it just kind of gives me a chill down the back of my neck to read that. Endless doors, not just one back door. Look at them all. All the back doors. >> Yeah. >> TPL Link has some issues, but this is a happier story. This is one of those patchy patchy patch patch stories, not the throw the routter in the bin or recycle it responsibly stories. Um, again, WordPress site owners, make absolutely sure you don't have any errors in your auto update and that you have auto update turned on because in this day of AI, not having auto update on on WordPress is not an option, folks. Uh, there was another patch to WordPress core. So, usually the problems are in plugins way more often. This was in WordPress core and it was arbitrary code execution. So that's really bad. So if your WordPress wasn't updating itself, it's probably hacked. So you need to check for rogue admin accounts. If you are using one of the either the themes or the plugins uh by a company called BD themes, I don't think the themes are that popular because you pay for them, but they have a series of plugins called Elementor that is really popular. Everything from that company was affected. So if you use any of these the there's a list in the story in the show notes. If that if you know the name Elementor rings a bell, you need to check this out. Now, you should be fine, Allison, because we know who your theme is from, and it's not from these folks. >> Right. Right. >> Yeah. >> But I but I did get a WordPress uh update uh request that it didn't do automatically >> from 7.04 to 7.1. And I was in uh on hotel Wi-Fi that wasn't working very well with uh tail scale on, but I can do it from your house now. Yes. And you're okay there because if there was a nasty security bug, they would give you a 7.0 point something without forcing you to 7.1 something. >> Okay. Okay. >> I may have pushed the button right now anyway. >> Oh, that's absolutely fine. You're always better being more patched, but >> they won't leave you critically exposed. But you still patch. Okay, worthy warning. Just the one here. iOS users need to be aware that there is a small leak in iCloud private relay. And >> this is one of those things where the issue is basically that with iCloud private relay on there's a whole bunch of APIs that are supposed to go through iCloud private relay. And so it allows individual apps to behave as if only those apps are in a VPN. So it's appsp specific VPNs. So that's really difficult to do because the operating system is running lots of other stuff that isn't going through that tunnel and some stuff is and Apple need to not forget a single function anywhere in their operating system or there's a tiny leak. They did forget a few functions. So they're going to have to do a few patches and this affects single app VPN like behavior. So tour iCloud private relay and something called Silio. >> It does not affect whole phone VPNs cuz those aren't trying to do this kind of a magic trick where you're both on a VPN and not on a VPN which is the difficult magic trick to pull off. So, if you're just using a full VPN, none of this story affects you. Even if you are using one of the like tour or something, this isn't going to decrypt your traffic. It's just going to in certain circumstances leak your true IP, which is for most people most of the time not important, but for some people some of the time stupendously important. And those people need to use full VPNs for the next while because tour isn't 100% reliable. >> Okay. >> So, it's not catastrophic. It sounds >> explanation. >> It sounds worse than it is, >> but it's not good news. >> Okay. [laughter] >> By the way, I [snorts] would have pronounced that silo. It's p s y l o. >> You're absolutely right. And that makes perfect sense >> for given what the book does. It's a silo >> just spelled funny. Okay, you're right, Alison. >> Yeah. >> Oh, I just heard it. Silo. [laughter] >> See, I didn't heard it when hear it when I said it. I just pronounced it. Okay, we're all together on the same page now. >> Yes. >> Okay, so we have some notable news. Uh, so Apple have been doing a thing for a while when they detect so-called mercenary spyware, the really high-end stuff um that our friends, our Israeli friends, what are they called again? Oh, I'm so bad with names. >> Oh, yeah. Those guys. >> Yeah, just me. That's all good. >> Anyway, whenever they detect this really, really advanced spyware may have compromised the phone. They've been sending people warnings to say, "Hey, we have evidence that your phone might have been targeted in this." They've done it again, which is great. But the kind of the scary thing is that the scale keeps getting bigger. They didn't. Last time they sent out like reports to 100 people. This time they sent reports to people in 110 countries. We don't actually know the total number of people, but that's a lot more. >> Also, Apple are getting better at doing this in the sense that people who got these last time complained that it looked like spam because it was an email from Apple. Now, it was a properly signed email and everything and it was verifiably real, but people are rightly suspicious of emails. And so, Apple have added extra proof by doing it through a push notification, which is something that someone who's not Apple can't fake because the push notification will come from an app. And in this case, the push notification comes from iCloud. So, that's not spoofable. And also, okay, when you log into iCloud, the warning is on your iCloud home screen. Again, not fakeable. >> Oh, [laughter] >> yeah. So, they're making it easier for people to know. No, no, seriously, folks. You You have been targeted by this. You need to talk to your security people. >> Wow. >> I want to get that email. >> Yeah. I'd hate to get one, but I love that Apple send them. >> Yeah. Yeah. [laughter] >> Okay. There's a piece of news from the United States that is significant, but I don't really know what to make of it. So, the White House taps security firms for offensive hackback operations. So, as well as government agents doing cyber attacks to hack hackers back, the US government will outsource that work to cyber security professionals. And that's not inherently good or bad. There are lots of countries that do this. The question is what are the safeguards to stop this being abused through corruption or cronyism? And that's the bit where I don't know what to make of this. So I will leave that as an exercise to the listeners. I know there was some hyperventilating all over the internet. The concept of governments having contractors is not problematic. These are just government contractors doing a thing. AND A LOT of work is done by government govern contractors. I mean that it's a massive percentage of the people working for the US government are contractors. But uh >> and if they're qualified and that's why you say cronyism makes you worried a little bit. >> Yeah. >> Yeah. If you think about it, do we want the government to be training people to be aeronautic engineers or do we want aeronautic engineers working for the government? I think we want aeronautic engineers being, you know, hired by the government to do aeronauticy stuff. >> It's why would it be different in cyber security? You you get the best people, >> right? >> Right. So, yeah, like I say, it's it's news. I don't know how to how to I don't know how to say what it means. I'm just telling you what happened and you can decide what you think it means to you. >> Okay, fair. Yes. Meta have been ordered to pay $567 million in a massive child safety case. Now, that's kind of big news, but this happened in a state. So, in this case, the state of New Mexico. If every state were to do that, that would be rather problematic for Meta. So, needless to say, they will be appealing. But, I'm just going to read you the summary from the Mac Observer. Again, this isn't a Mac story, but the Mac Observer folks are really good at reading court documents and summarizing them for humans. So, I I always end up quoting them because they're good at this. So, a state court has ordered Meta to pay 567 million to address mental health impact of its uh platforms have on young people. I messed up that sentence. to address the mental health impact its platforms have had on young people. The judge ruled that the company created a public nuisance by designing features that keep teenagers addicted to its apps. The judge laid out a strict 5-year plan that forces the company to overhaul how teenagers experience Facebook and Instagram. The new rules require monthly time limits for younger users and place tighter restrictions on how adults can interact with minors on the platform. That seems awfully sensible. >> Well, it's kind of weird to have a court lay out the plan. Like usually they tell you what you've got to achieve, not how you need to achieve it. Like this sounds it's telling them the how. I'm not sure it is, Alison. I think it's saying the what? It's like you have a bunch of these addictive features and you got to stop doing that. >> But you have to a five strict five-year plan implies that there's steps along the way of features or something like that. Well, we'll find out. >> Yeah. I mean, could be goals. Could be a fiveyear timeline of goals. >> Yeah. Not >> right. Do you need to be here by then? Here by then, here by then. >> Yeah. And we are going on a summary from the Mac Observer. So I need to be careful not to speak too strongly. >> Sure. Sure. But no, who doesn't [clears throat] love this, >> right? Exactly. Um, also this is in the good news pile. Europe is creating a common security standard for VPN services. So there's a standards body has begun the approval process for new cyber security standards introducing defined technical and privacy requirements that could eventually give VPN vendors a recognized way to demonstrate compliance. So you'll be able to have like a a kite mark or a cark or whatever you guys call it for VPNs like you have on electronics and stuff. That's cool. Yeah, I like that. And I was initially a little bit like, oh no, is this bureaucrats trying to be tech? So I did a bit more digging. Uh the people basically the bureaucrats have asked the experts to help. So Google, PaloAlto, Nord are some of the companies helping to find this standard. So that will be NordVPN, PaloAlto Networks, and Google. These people know what they're doing. So this gives me a lot of >> Oh, good. Good. Yeah. Yeah. I like it. >> Yeah. Okay. And now we get our little wrap-up of nice new security related features. None of these features will solve world hunger on their own, but all of these features will make us all a little bit less insecure. So, I said nice things about Microsoft a few months ago when they promised to start paying down their technical debt in Windows and removing legacy features that were being abused by attackers. A particularly annoying one that malware adores using is something called WIC. Windows users have never heard of it because no one bloody well uses it apart from malware. >> It is gone out of the latest versions of Windows. If you need the actual WI technology itself, it's still there. You just got to use modern PowerShell instead of a legacy buggy CLI app no one knows about. So this is good. >> Excellent. >> Signal are also continuing to make their app more user friendly. So I kind of think Signal are interesting. They started off perfectly secure which wasn't all that user friendly. They have not sacrificed any of their security but are working to make the app ever more user friendly. Uh which is an interesting way to go about it. But I think they're now getting close to feature parody with stuff like Telegram, but with full security. So what we now have is you can do device linking on Android and iOS. So that means you can have seamless syncing of your conversations across Android and iOS devices with signal >> which I know. >> Okay. Could you before like within a family like within iOS you could or within uh Android but now it's across those. Well, there was a bit of faffing about. You basically had to scan a QR code and you weren't your account wasn't really linked to your phone. It was like a guest on your phone for a month and then if you didn't use it for a month, it would expire. >> Now you just get to install it and it sticks. >> Okay. Yeah, cuz that was one of the features that drove me nuts. >> Yeah. I thought of you as soon as I read about this feature like okay this is getting more this is more like the kind of thing Allison wants where you're not faffing about like I mean obviously you want security but you also don't want to have to suffer for your security what you want is security with no trade-offs. >> We're getting closer. >> Sure. >> Okay. >> And just to prove they haven't given up on security they have also added a new feature that makes it even harder to do they Okay. Okay, the headline says man in the middle. I'm sorry, that is outdated terminology. Attacker in the middle. AITM. Basically, they do automatic key verification so that if someone tries to add a new key into a conversation, you will be proactively notified, making it even harder to abuse the already secure protocols. >> Okay, cool. >> WhatsApp are adding ondevice scam detection. H and they're doing it on device which for Meta is kind of amazing. So there's a really big point here that this is this is local LLM features basically. So because our iPhones and stuff have these AI chips on board and so does Android. So do modern Android phones, it's using the onboard AI to detect scams. So yay. That's cool. Yeah. Not sending the chats to Meta. That doesn't sound like them, but okay. Yeah, let's assume that some of the regulations somewhere are having some sort of effect somehow. It's Braves. Anyway, uh Brave are continuing to make their browser the most difficult to track you on. Um so every time the browser companies shut down one of the side channels for following you, one of the, you know, they used to like get the list of fonts you supported and use that to try fingerprint you. And so then the browsers just started to lie about the the fonts that were installed. And then they were using your screen size. So all of the browsers started to fudge the number to the nearest 10 pixels. And then it wasn't nearly as useful anymore. They found a new way to detect your unique computer by giving it a certain bit of graphics to do and timing how long the GPU takes to do it. It's called GPU fingerprinting. So Brave have now added some fuzziness into that signal. So that signal is gone in Brave as well. It's just great. You know, the more we fight tracking the better and I'm sure this technology will go beyond Brave. So go them. >> Mozzilla are also doing good things. Um they have built an ad blocker into Firefox for iOS. Uh the option it's not instant on. I guess it they're they're rolling this out. You know the way on iOS a developer can put out updates to come out slowly over time. this is rolling out in that sort of a way. So this will appear for people over the next days or weeks, but it's not going to appear all at once. I >> So would that be on automatically or? >> Yeah. However, this there's an interesting little I think a very embarrassing side note here. Uh because of some conflicts of interest in how Mozilla make money, their ad blocker has built-in exceptions for ads in search results because Mozilla is almost completely funded by their Google partnership. And also the Mozilla web page is immune from the ad blocking because they sell ads on their own page. >> I don't like this. It's a bit embarrassing, but nonetheless, having an ad blocker built into the browser out of the box is still nice. But those two exceptions are like, yeah, folks, do you understand there's a problem with where your finances are coming from? So, there we are. >> Yeah. Now, there is one other silver lining. Some ads are allowed through, but no trackers are allowed through. So, even on the sites that are allowed to show ads, trackers are blocked. So that's better, >> right? >> Yeah, like I say, it's still embarrassing, but it's still better than nothing. So it's it's still a good news story. Um, also in the latest version of Firefox, but not just on iOS, this is Firefox everywhere. Um, they are dealing with an annoying side effect that attackers abuse. So we have home routers that act as one-way valves because of something calledNAT. So something on the internet can't reach into your house and go to a specific IoT device. There has to be something in your network to be able to see other things in your network. Well, when you visit a web page, your browser is in your network. So if your browser can be tricked into making a network connection to the IoT device, then your browser is acting as a kind of an unwilling proxy. That requires your browser to be allowed to connect to LAN addresses. That is now not going to work by default in Firefox. If a web page, maybe a malicious ad tries to access your LAN, Firefox will step in and go, "Are you sure you want to allow this?" So, if you genuinely need to connect to your LAN, like there are, say, if you're on the Plex website configuring things, Plex will legitimately do that to update something on your Plex server through your browser while you're on the Plex website. But again, Firefox will ask you if you're sure. So that's a good thing. >> Okay. So it's it's not just completely blocking you. Well, I always think about what if you've got a web-based interface to your router. >> Again, what it's doing is it's blocking it happening silently, not blocking it. >> Gotcha. Gotcha. Okay. Good. >> Exactly. So I'm delighted. Um, we have no top tips. We have no excellent explainers, but I do have some interesting insights. So, Proton, which is the company behind ProtonVPN, Proton Mail, and the Lumo AI agent have released a new tool that helps you understand how much of your privacy is being given away when you interact with chatbots. So, the the app or the service is called AI paper trail. And what you do is you take the export you can get from open AI or uh Anthropic. So you know the way if you're doing claude or chat GPT for a while you can ask it for a full export which you can then use to import yourself into the competition. You can also take that export and put it into this tool and it will give you a report of everything the AI has figured out about you in your interaction with it. And this is kind of a fascinating way to see I I actually genuinely don't know how much I've inadvertently given away to chat bots by using AI because how many of those little things I've said have actually given stuff away. How could I know? So that's kind of why I like the idea of this tool and why I think it's genuinely useful. But we do have to say Lumo are not doing this for the crack. They sell a an end toend encrypted chatbot which I happen to buy and love called Lumo. The reason they're making it so easy to figure out how much a chatbot can know about you is because they will sell you a chatbot that doesn't know anything about you. So there is very much an ulterior motive here, >> but it's still a cool tool. >> I'm very very confused though. If you are using say Lumo >> and you put in a lot of information into a chat, the export would include all of that information that you gave to Lumo. So the AI paper trail would say that Lumo knew a lot of stuff about you. How is this okay? So with Lumo that is all of that stuff is stored locally and none of it ever goes to Lumo. So like when you sync stuff to the export Apple can't know it >> but but in Claude with Claude and chat EPT how do you know that what it's the export is stored in their cloud? >> How do they how do you know that information's leaked anywhere? Okay. I don't know enough to say that any more than the people who know how this works say that's how it works. I I'm afraid I can't. >> I think I think I'm I'm asking a much simpler question than the way I'm articulating it. I've got a bucket and I'm pouring water into it and this tool is going to tell me what water I poured into that bucket. No matter no matter which tool I'm using, I poured water into the bucket. That information exists and would be there in an export. Yes, >> because it was in the bucket. >> But the difference is with Lumo the bucket is end to end encrypted. So the bucket is only known to you. With the other tools is not end to end encrypted. So the bucket is shared. It's a communal bucket instead of a private bucket. >> Okay. Okay. >> Yeah. So the reason they want you to pay to have your bucket be private is because of how much is in the bucket. And the reason they have the tool is to show you how much is in the bucket. And therefore you should start to pay them to have the booket be secret. >> Yeah. Yeah. >> I may have tortured your >> I think I understand. >> No, no, no, no, no. I think that's good. I think it's good. Okay. >> Okay. Now, we you have been busy traveling the world and viewing eclipses. So, the show notes have a placeholder for pallet cleansers from Allison. Is there a last minute edition or will my three have to do? >> No, that'll do. Did you mean to skip the max security just got trickier latest threat report? >> No, I did not mean to skip that. >> Okay, >> I will get to that in a sec. Sorry, my darling beloved just texted me because obviously I'm podcasting and that's why he should do anyway. I'll get to him in a sec. >> Well, we have been going on for a while. So, okay, >> that's fair. Okay, so the latest threat report from a company called Moonlock um is sort of telling us what's going on in the real world of Mac security. And we we tend to get overlooked a lot of the time as Mac users because everyone's focused on Windows users. And it's kind of easy to forget that yes, Windows is attacked more, but no, the Mac is not some sort of utopia where we're all perfectly safe. So, what I like about this report is that it's a levelheaded, sober analysis of what's happening. Not an auga auga, give us all your money and we'll solve a problem that is that we've blown out of all proportion. It's a real analysis. And I'll give you the really important summary. These clickfix things we've been warning you about where you're made to copy and paste something into something, they're the threat. They're what is currently attacking Mac users and everyone else. So, any website that tries to tell you there's a, you know, you're going to fix your problem by pasting this code you don't understand into this window you'd never heard of before, the answer is no. >> Okay. >> Yeah. Okay. >> Good. Now, >> now you can pallet cleanse, Bart. >> Yay. Okay. I don't think I've ever done a tip before as a pallet cleanser, but this just made me so happy that I just have to share. One of the things I [clears throat] really don't like about iOS is that the settings are not in the app a lot of the time. So, you're in an app and you want to do something and the settings are in the settings app where you have to scroll through a list the length of your arm because I installed too much software. Well, >> right, >> you can use a shortcut to detect the current app and you can use a shortcut to open the settings for any app. So, someone took those two pieces, put it together into one shared shortcut that you could just download and install, and then you add this shortcut to that little thing you pull down from the top of the screen, >> and it will open the settings for the current app. >> Oh, really? Whatever's in the foreground. >> Whatever. >> You're actually running it cuz cuz control center is a a an overlay. Yeah, >> exactly. >> Wow. >> Yeah, that's the name of a control center. And it works, Allison. So whenever something g gives you like a notification you don't want or something just have the app open swipe down and I click this shortcut and then the little setting to tell it never make a bong again is right there in front of me and I just change it. >> So nice. >> Hey, you know what's cool? Bart, you can show this to me while you make me dinner. >> You have to read the link because while I'm making dinner, Allison, I will be needing my attention to not burn your dinner. Well, fine. Okay, after dinner then. >> Over dessert, I can do that. But while I'm making dinner, I I should be a bit less distracted. >> Okay, fine. >> So, we know that XKCD is funny the first time around. >> Well, AI has changed the world so much that there are some XKCD comics which are now funny in a whole new way. So Steve Gibson obviously had too much time on his hands because he was reading the back catalog of XKCD and he found a comic that at the time seemed ridiculous and now it looks like what's happening in AI. So you see a person >> sitting at their laptop says start Wi-Fi autoconfig searching for Wi-Fi. Found no open networks. Found a secure network named Leanhart family. Trying common passwords failed. Checking for web vulnerabilities. None found. Connecting to the Bluetooth phone. Calling local school. Found Lionheart children. Notifying field agents. children acquired calling leanheart parents negotiating for a Wi-Fi password and you just see control crol cic was called zealous autoconfig and Steve Gibson has recaptioned it AI agent was determined to succeed >> oh and it works out so sad >> this is just like [laughter] those news stories >> it'll it'll do it'll do it Wow. >> Yeah, that sounds great. >> And finally, there's a fantastic BBC podcast that they do like six episodes, tell a big story, and then they go, well, they don't go on hiatus, they do research for a year, and then they come back with six stories and do more research for a year. Anyway, season 3 is out. It is all about probably one of the first the first ransomware groups we knew by name, Conti. It tells their story and I sort of thought I knew everything about Kanti because they did slightly hack the entire health care system in the middle of CO which we did notice when all of our hospitals stopped working in the middle of CO. I knew that bit of the story. There's a lot more to where Ki came from and what happened them afterwards that I didn't know. They're halfhour episodes. There's six of them. They are extremely approachable. There are no propellers anywhere near any beanies and it is fascinating. So, it's called Cyber Hack the Conti Files. >> Wow, that sounds great. Well, I feel like we must not have been together on security bits in a long time because it's been an hour and 11 minutes here. Oh, not counting the faffing about we did in the middle of the beginning, but uh this is this has been a lot. Yeah, I don't think it has been extra long. Allison, I think it may be the age of AI. Uh oh. A lot happening, huh? Yeah. [laughter] For now, anyway. >> All right. Well, I think we should probably let class go. >> Indeed. And the good news is no matter how many different bugs AI finds, the answer remains the same. Stay patched so you stay secure. Well, that's going to wind us up for this week. I can't believe we were able to get a show out today. We literally came home last night. So, uh, again, many thanks to Alistister and all of the contributors for making this happen. But that is going to wind things up. So, did you know you can email me at allisonpodfey.com anytime you like. If you have a question or suggestion, just send it on over. Remember, everything good starts with podfeed.com. You can follow me on mastadon podfey.com/mastadon. If you want to actually see my podcast work on YouTube, you can go to podfey.com/youtube. If you want to join the conversation, you can join our Slack community at puffy.com/slack where you can talk to me and all of the other lovely noilic castaways, even Bart and Alistister. You can support the show at puffy.com/patreon like Allan did this week or with a onetime donation at podfey.com/donate. You can use Apple Pay there or any credit card [music] or you can use PayPal at podfey.com/payal. And if you want to join in the fun of the live show, I'm pretty sure we're going to have one next week down at Lindsay's house. [music] Head on over to podfeat.com/live on Sunday nights at 5:00 p.m. Pacific time and join the friendly and enthusiastic [music] Nosilic castaways. Thanks for listening and stay subscribed. >> [music]