NC_2026_09_13

Hi, this is Allison Sheridan of the Nosiliccast Podcast hosted at podfeed.com, a technology geek podcast with an ever so slight Apple bias. Today is Sunday, September 13th, 2026, and this is show number 1,114. Before we get started, I want to tell everyone there will be no live show next week on 20 September. We're off to Canada for the weekend to see Lindsay, the daughter, who's temporarily working up there. And we get to hang out with friend of the show and friend of ours, Steven Gats. So, we're super excited about that. This does mean I'm going to try to get the show out on Wednesday, the 16th of September, which will be a bit of a challenge cuz that's only 3 days from now, but I bet I can get it done. We're gonna start out with Eddie Towny's final installment, for a while at least, of his wonderful series on how to record and produce an audio book. I want to explain two things. First, though, he's going to be talking about EQ, but he doesn't define that term at the beginning. Just in case you don't know, EQ is short for equalization. That's the process of adjusting the volume of specific frequency ranges within an audio signal. The other thing I wanted to explain is that you'll hear him describe three test versions of how he applies EQ, but then you'll hear him describe the three tests again, and then you'll hear him a third time, maybe even a fourth time. Turns out he's using his description of the tests as the audio tests themselves. And that really confused me. I thought, man, he made a mistake. And I started to delete them until I heard the third of the test, which sounded very different from the first two. Now, the tests very likely won't survive the processing I send the audio through, though. So, I put the original clips into his blog post so you can go hear the difference. With that, let's let Eddie explain how he's using EQ. EQ for audio books. Subtractive, boring, surprisingly effective. Hi, this is Eddie Toncoy, the in-house nerd for everything behind the scenes on my wife Jour's character-driven queer love stories, including audiobook narration and production. I need to start this one with a confession. I used to be completely lost with EQ. Not I'm still learning lost. I mean guesswork lost. I would watch the analyzer drag points around, do things that felt like they should be right, and then end up with a voice that sounded impressive for 10 seconds and exhausting for 10 minutes. I had tin ears for EQ, so I compensated by doing more of it, which is a wonderfully efficient way to make bad decisions more confidently. Eventually, I realized the problem was not that I needed a cleverer curve. The problem was that I was trying to use EQ to solve things that should have been solved at the microphone. Once I got capture right, mic position, distance, angle, and a consistent tone, that as recorded sound was basically already what I wanted for audiobook comfort, which means EQ stopped being design and became something much smaller. Remove one tiny annoyance, then get out of the way. So what is EQ doing when capture is already right? If the recording already sounds like a human voice in a stable space, EQ should not be trying to reinvent it. The audiobook test is not does it sparkle. The audiobook test is can someone listen for hours without their ears getting tired. So now I treat EQ as not a makeover, not a signature, not a curve I'm proud of, just maintenance, a small filter, maybe one small correction, and then I leave the voice alone. The funniest part is that the EQ I kept reaching for turned out to be basically one move, a gentle highpass filter. First, high pass and low pass because the names are annoying. Since I still mix these words up sometimes, here is the simple version. Pass means what gets through. A highpass filter or HPF lets highs pass and reduces lows. It is the remove rumble or mud move. A lowass filter, LPF, lets lows pass and reduces highs. It is the remove hiss or soften harshness move. For most narration chains, if I only do one EQ move at all, it is usually a gentle highpass filter. Subbase does not carry much meaning in speech, but it does eat headroom and make everything feel thicker than it needs to. A lowass filter is rarer for me. It can be useful if there is a specific highfrequency problem, but it is easy to overdo and make the narration feel blanketed or dull. Here is what changed once capture was right. Once I stopped fighting the recording, something calming happened. I could bypass all EQ and still feel, yes, this is the voice. So that's changed the protocol. So now first I listen to the raw or dry chapter before doing anything. If it already feels comfortable, I do not go hunting for problems. Hunting for problems is a very reliable way to find some. Second, if anything is needed, I start with a gentle highpass filter. Not because it's trendy, but because it removes low energy that does not help intelligibility. Third, I stop early. If I feel tempted to stack moves, I take that as a warning sign that I'm back in the old world of guesswork. At that point, the right fix is usually upstream, placement, distance, angle, consistency, or sometimes a retake. The hard boundary is if it takes more than a couple of gentle moves, it probably is not an EQ problem. It is a capture problem. The useful distinction is resonances versus taste. And this distinction helped me a lot. Maybe because I'm a physicist. Sometimes EQ is solving a real problem. A small resonance, a bit of low-end rumble, a narrow annoyance that appears every time I lean into a phrase. That is problem solving. Other times, I am chasing taste, more warmth, more air, more presence, more finished. That is where I get into trouble because the 10-second AB can be very persuasive. A brighter, more produced voice can win quickly, but audiobooks are not judged in 10-second chunks. Over time, extra brightness can make sibilance and mouth detail more obvious. Scoops mids can make the voice seem impressive but less natural. Too much low-end warmth can become a kind of slow fatigue. So, I try to solve problems, not decorate the voice. Here is the demo. No filter, gentle filter, too much EQ. So, the demo for this is simple. Take a short paragraph and make three versions. Version A has no EQ at all. Just listen for comfort. Not whether it is fancy, whether it is listenable. Version B, add a gentle highpass filter. Sweep it slowly upwards until you can just start to hear the voice thinning. Then back off a touch. The goal is not to change the voice. The goal is to remove low-end material that is not really speech. And then level match when you compare because EQ changes can trick you just by changing perceived loudness. And version C, pass me's mistake. Add top end, scoop mids, make it sound produced. It'll probably win the 10-second comparison. Then listen for a minute or two and notice what happens. Sibilance and mouth detail become more present. Breaths and edits get more obvious. The voice stops feeling relaxed. So the demo for this is simple. Take a short paragraph and make three versions. Version A has no EQ at all. And now let's have the same one, but version B. Add a gentle highpass filter. So the demo for this is simple. Take a short paragraph and make three versions. And now let's have that again but with version C. Pass me's mistake. So the demo for this is simple. Take a short paragraph and make three versions. So again listening in a podcast you may not notice much difference because you're not living inside it for 10 hours. But that is why audio EQ has to be boring to be kind. So where does that leave us? The compact takeaway is tone is chosen with placement. EQ is a nudge. Most of the time a gentle highpass filter is enough. And if I need more than a couple of moves, I should not draw harder. I should record smarter. EQ is not where I find my voice. I found that earlier with placement. EQ is where I remove the tiny annoyances that stop people listening for hours. So that concludes this series V3 of my audiobook recording process. I hope you gained some value out of learning about my process. It certainly has helped me. I've been using it for over a year and I've had long pauses of months and I've been able to come back and keep the tone, keep the sound right. So even within the same audio book recorded months in separation, it still sounds like the same room, like the same narrator. If you want to know more, come and ask me over in the Slack community at podfeat.com/slack, where I and all the other lovely Nosilla Castaways enjoy friendly, positive online conversations. Feel free to message me, Eddie Toncoy, if you have any thoughts, questions, or techniques you're using. It would be nice to share ideas. You can also find our work at jerntooncoy.com. That's j e r n t o n koi.com, where you'll find J's character-driven queer love stories, the audio books I produce for them, and bonus material for our subscribers. I'll be back soon to talk through some more of my workflow, but for now, happy recording and happy reading. You may remember when Steve and I performed the emergency Mac Mini upgrades of 2023 for Steve's mom and dad, Merly and Ken. We went to visit them about 4 hours away and while helping them with some computer stuff, we realized that their Mac minis were 9 years old with 5400 RPM spinning hard drives. As I said my article about this, do you feel lucky? Anyway, that very day we replaced them with two Mac minis, two M2 Mac minis with 256 GB SSDs and 8 GB of RAM. I was amazed that we went from coming up with the idea early one morning and then bought the new machines, found all of the adapters to connect their ancient monitors to the new Macs at different stores, transferred all of their data all in one day. It was a miracle. Now, while these were quite modest Macs, they they're perfect for Steve's parents' modest needs. They've just recently moved from independent living to assisted living in the same facility. And while the services are wonderful and the people delightful, the new apartment is less than half the size of their old one. They had to downsize from a two-bedroom apartment to just one with a much smaller living room as well. Before the move, Merly had a desk for her computer, a desk for doing crafts, and an upright piano. In the new place, she was relegated to just a single desk, and she had to lose the piano. Now, she did get a piano keyboard, so that's working out as a place to practice for her performances. But her Mac Mini display, keyboard, and mouse were taking up the entirety of her one tiny little desk. She suggested that if she had a laptop, she'd be able to move it off the desk when she wanted to do her crafts. Her latest crafts are lovely cards she makes by hand and really cool wood wall hangings. She let me share a couple of photos of them with you, and they're in the show notes. Now, you know, I love to have people spend their money on Apple Gear, so I jumped into action. While a MacBook Neo would be a perfect Mac from a capability perspective, she'd be going down from a 17-in horrid old display to a 13-in highresolution display. And I thought that might be too small for her, even though it's a much better display. I explained the trade-off of money versus screen size with a 15-inch MacBook Air at double the price. Luckily, money is not tight for them and she was able to choose the bigger screen. I recommended we get her the 12 South curve, which is an elegant stand to lift the laptop up off the desk and then puts the display at a very comfortable viewing height. It's a very simple single piece of metal that kind of swoops around to hold it at an angle. I have one on my own desk and it lets me put my MacBook Pro up as a display to my right in addition to my main display. Marie was an accountant in her working life and cannot live without the 10key number pad on the extended Apple keyboard. She has a mouse she likes too. My goal was to let her keep those for comfort and familiarity. An additional advantage of the curve is that gives you an open space underneath, which means she could stash her keyboard and mouse under the MacBook Air when not in use, which would give her temporary space to do other tasks. Maybe not a full-on art project, but at least a space where she could, you know, work with papers and maybe balance her checkbook. The Mac Mini had two USBA ports and two Thunderbolt ports on the back. So, we had to figure out how to plug everything into the new MacBook Air. I made a FaceTime call with her and I had her trace each cable around to see what we were working with. I knew her keyboard was wired USBA and that she had a USBA dongle plugged in somewhere for her third party wireless mouse. The good news was that the mouse dongle was plugged into the end of the keyboard, so we didn't need another port for the mouse. For video calls, she had a Logitech C920, also plugged in via USBA and used wired headphones because the audio out of the Mac Mini was nearly inaudible. Finally, she has an SSD for Time Machine via USBA. After counting up devices, it looked like I could simplify her setup with a single USBC hub from Ankor with four USBA ports. I'd be able to harvest the two USBA to USBC dongles back to my stash at the same time. With BackSafe charging, she'd even have one USBC port left open. Now, you know, I'm a big old fan of doing a nuke and pave for me when I get a new machine, but I know that Merly doesn't junk up her system with a lot of apps, so the amount of cruff she would have gotten transferred over the last two migrations was certainly minimal. It was worth giving migration assistant a chance. I double checked that her time machine backup was current, which it was. I plugged it into the new Mac and let Apple do its thing. She doesn't have a lot of data, so the transfer only took about 15 minutes for all of her apps and data to be on the new Mac. I should tw qualify that statement. They use a fairly specialized app at their facility to keep track of, you know, what's going on in terms of entertainment, food, menu options. And for some reason, that app did not transfer. I was able to install it pretty easily. Now, because Microsoft just loves to make things difficult, Word and Excel also didn't transfer. I knew I was about to descend into the seventh circle of hell with Microsoft. But I love Merly dearly, so I crawled through the labyrinth of Microsoft's website to get her precious Word and Excel back. I asked Perplexity AI to find me the instructions to first uninstall Office 365 on the old machine. The instructions Perplexity gave me were ridiculously complicated and I knew they had to be wrong. But I followed the link to the source at support.microsoft.com. It's one of the reasons I like Perplexity is it always gives me the source. Unbelievably, these arcane instructions are what you have to do. Just for everybody here who's ever tried to do something like this, I want you to listen to what Microsoft tells you you have to do. First, put the apps in the trash. So far so good. In Finder, go to tilda library/containers. Delete the following folders, some of which may not be present. Microsoft error reporting, Microsoft Excel, com.microsoft.netlib, let's see, ship passerty process. Not sure what oh ship assert process. That's probably what that means. com.microsoft.off365 service v2 Microsoft Outlook Microsoft PowerPoint com.microsoft.rms-expc RMS-XPC service Microsoft Word, Microsoft OneNote. But we aren't done yet. That's just library containers. Now in Finder, go to the user library group containers and delete the following folders if present. And these are even worse. Ready? UBFAT346G9.ms UBT I'm sorry, UBF8T346G9.off and UB F8T346G9.off. Office OSF web host. Seriously. Then you remove the apps from the dock and restart the Mac. Can you believe they ask normal people to do this? I wonder if most people just go buy a new subscription instead of figuring out the old one. Now, the other tricky part about installing Office 365 is making sure you only install the parts you want. She wants Excel and Word, but she doesn't want PowerPoint. She doesn't want One Note. She doesn't want Outlook. She didn't love want any of the other things in that giant bundle download. Luckily, I'm quite filled with installation packages and I knew to keep my eagle out for the customize button and uncheck all the GOPs she didn't want. Once the new Mac was functional, we set it up on the 12 South Curve, plugged in her keyboard and mouse, and I had her take a look. Her reaction was fabulous. She said, "I feel like I got new glasses." You see that 17-in display we decommissioned had a sticker on top that said from Allison 2018. It was super low resolution. It's so dim you could barely see anything on it. When she saw the blindingly bright display of the MacBook Air, she was amazed. In fact, she had me crank it all the way up to to full brightness, which is the way I like it, too. I'd been itching to replace that display for ages, but she'd seemed happy enough with it, and I didn't push her on it. I was a little worried that the smaller screen would be a problem. And she said that somehow the MacBook Air screen actually looked bigger. She has good vision, so I think she's experiencing the higher resolution giving her more on screen than she ever had before. Now, I started to take a look at how we'd connect the rest of the peripherals, and this is when we hit some really good surprises. Remember that fancy Logitech C920 camera we bought her bought her for her old Mac Mini? Well, that once fancy camera is only 3 megapixels, while the MacBook Air sports a 12 megapixel sensor with computational video processing for low light. I asked Marie to open up Photo Booth on her new Mac to see how that internal camera looked. And when she saw her face on the screen, she screamed with horror. She's funny that way. She's a beautiful woman, but she likes to make fun of when you know she's old and she doesn't want to say that she's beautiful, but she really, really is. Anyway, I told her that as a treat, if she was good, I'd show her where in the zoom settings, I changed the video to touch up my appearance to remove wrinkles. So, the camera in the MacBook Air is so good, we decommissioned the C920 on the spot. We ran a test FaceTime call between my phone and her Mac, forgetting all about how she always used used to use headphones before, and the speakers were so good on the new Mac that she said she didn't need the headphones either. The internal microphone on the MacBook Air was great as well. Now, the elimination of the external camera made it possible to eliminate the little hub I'd bought for her because all we had left was the time machine SSD and the keyboard. It did mean I had to give back the USBA TCO dongles, but it meant even less clutter for her to deal with. She wouldn't have this hub hanging off. I next gave her a lesson on how to break down her setup to use her desk for crafting. I had her practice removing the MagSafe charging cable and unplugging her keyboard from USBC. I showed her how to gracefully eject her backup drive before unplugging it. She questioned, "What's so grace graceful about that?" She was messing me, but I also confessed her that she might be able to get away with unplugging it without ejecting, but that it's good practice to get in the habit of ejecting it first. And while I had great fun spending her money and setting up her new computer, the real test would be whether the new setup worked for her. 2 days after we got home, she sent this message. I am loving my new computer. It's giving me a whole new way of making things easier and more workable. I have more a sense of control over being able to live the life I had before. Life is good. I got to say, if that's not a seal of approval, I don't know what is. Now, I'm going to tell you one more thing that's not in the article. Someone asked me offline uh how old she was. And you know, I didn't say exactly how old she was, but I asked why they were asking. This person is a an Apple consultant. and he said that he always for anybody over 75 years old he convinces them to get an iPad that they shouldn't be using a computer at all or maybe it's too confusing for them and I thought that was interesting because Steve's mom and dad are amazing I mean it really has no trouble at all with Excel Word using the computer designs things for her crafts she's all over Pinterest and I mean she definitely has no trouble Steve's dad is a little bit older and uh he asked me to help him with this giant Excel spreadsheet he has that he keeps up to date with all of his financial information. He does all of the equations on his own and everything. But what he asked me, he said, you know, I'm trying to to take this date and and drag it down so that it updates, you know, so that it's a series. So it says 92, make it 93, 94, 95. And he was trying to drag it down and he was just clicking and dragging on the cell. And I said, "Oh, well, you know, you can grab the bottom right corner and then you see the cursor change to a little plus and drag that down and then it works." So he reached up and he did it and he said, 'Oh man, I used to know how to do this and and it really bothers me that I'm forgetting these things. And I looked at him and I said, 'Ken, you're 91 years old and you're using Excel there. There's nobody your age who does that. I mean, you're you're in amazing shape. So they're both uh very good at it and it's it's really fun to have them both working on their computers and enjoying them. And u does have an iPad, of course, but she uses her Mac as well. One way you can support the show is by using one of my referral links. Just last month, a kind and anonymous noilic castaway remembered to do just that when they signed up for setup. They got a free month of setup for doing it. And so did I. Now, you might wonder how they found the setup referral link and what other referral links I may have available. There's a whole bunch of ways you can find out. On podfey.com, one of the big red buttons says support the show. This button simply scrolls the page down till you see all of the different options. One of them is a cute icon I got from the noun project of someone handing someone else a big bag of money and it says referral links. If that's too hard, every single podcast episode has embedded show notes for your podcaster and the referral links are all listed there. I'm not sure I always remember on chitchat, but I definitely do on the no siliccast. Still too hard? Well, the chapter link for this very panhandling segment goes to the same referral links page. Thank you so much to whoever bought setup and helped me save some money. Well, it's that time of the week again. It's time, my favorite time of the week. It's time to talk to Bart Bush about Security Bits. How you doing today, Bart? >> I am doing good. And I'm a little discombobulated and I know you are too because we normally do this a day later, so the news is really fresh. So, something really exciting happens in the next 24 hours because we're recording this on Saturday, our listeners won't know. >> And I was completely confused. I was busy hastily previewing the uh the show notes for Programming by Stealth, which isn't for >> two weeks, two more weeks. So, but I'm going to be ready. I won't remember what my questions were, but >> that's true. Yeah. Okay. So, we have some follow-ups to things we've talked about before. Um, age verification has become the story that's not going away anytime soon. Um, earlier in the year, Apple gave us new APIs so developers could get age ranges. So, not a date of birth, but like an age indication of this is a or not a 13-year-old, sorry, a young teenager or an old teenager or someone under the age of nine or whatever. uh Microsoft followed suit. So Microsoft's operating systems now offer those same APIs. So again, you know, parents need to set it up and stuff, but >> it's available so developers can use the APIs. >> Very good. I like it. >> Yes. Um your your local legislature in California has made a welcome tweak in the age verification law that is coming into effect there at some stage quite soon. I think this that's um January next year I think. Uh basically open- source operating systems like Linux are exempt from having to gather evidence of agent stuff which would never have worked for an OS that has no company to gather information. >> Yeah, I I had not thought about that. Yeah, that's a good point. Huh. >> Yeah. So, and it's quite well written low actually. Um, so that is that was very welcomed in the open source community. You got lots of lots of good praise for California. Um, as the law intended, the European Commission have updated their list of large online platforms under the digital services act. So the law doesn't say which um companies should be regulated. The law says here are the conditions and every year the commission have to check who adds to the list and maybe who gets taken off. No one's gotten taken off yet, but could happen. Well, we have three notable additions to the list. Chat GPT has been designated a very large online search engine. >> Oh, that's Yeah. So they are now seen as equivalent to Google in terms of having a an abnormally large share of the search market. That is big news for Chat GPT. >> Do they have a designation of very large AI engine? >> No. Strangely enough, the law written just a few years ago never thought of that. >> That's what's wrong with these kind of laws, you know, trying to trying to chase tech. That's hard. >> It is hard. and they wrote it really general, but no matter how hard you try, tech Tech will surprise you. >> Tech finds a way. >> Yeah. Uh, Reddit and Roblox are very large online platforms. So, that's equivalent to Facebook, not equivalent to a search engine. >> What's the definition of a platform? >> Uh, a social media site. Basically, it's for interacting with people. Okay, that's a terrible word for that because I would I would have put an AI engine under a very large platform. >> It is a very generic word. That is very true. >> Yeah. >> Yeah. But, you know, when you think about it, Reddit and Roblox are places where a lot of people interact with each other every day. >> I didn't think about Roblox being that big, but I've never paid attention to the size of of it. >> Yeah. I think we're a bit old. I think we're not quite the target audience. >> Well, is uh is uh Minecraft considered a platform, do you think? >> I Well, it might be if it was a big >> gaming platform. Oh, it's huge. >> Minecraft, >> but I don't think it meets the because to be a VLOOKUP, you do have to be very large and it's about turnover and stuff and about numbers of users within Europe, but it's fairly big numbers. Okay, >> now you got me looking for Roblox is 123 million users. How many >> many users in What did I just say? I just said >> Minecraft. >> Minecraft 212 million. So Minecraft is close to double the size of Roblox, but I'm not sure it counts as a social media platform. That's a gaming platform probably. Is >> Yeah. if anyway. >> All right. >> Those companies and all this means is that they have to meet the higher bar. So they now have extra responsibilities for protecting children and so forth, which especially for Roblox seems like a good thing given the audience. >> Yeah. >> And then finally, Oklahoma has joined the list of states where a driver's license in Apple Wallet is not promised, it is delivered. The service has gone live. >> Good. Now, we have been rather dramatically soliciting for questions from our listeners in partv.com/slack. We have ourselves a question from a certain Mr. Alistister Jinx. So, thank you, Alistister. All right, cool. So, what Alistair posted was, "A service I use has just introduced two-factor authentication via SMS, while another I use has just removed this option, citing its insecure nature. I know any 2FA is better than none, but in 2026, how insecure is SMS 2FA really? >> Did it get more secure since I last researched this?" No, definitely not. >> Okay, just checking. >> Yeah. So, SMS is inferior for two reasons. So, the first reason is that it's not fishing resistant, which is not unique to SMS. We'll talk about that in a minute. But it has a bigger problem than the other non-fishing resistant ones, and that's that the actual infrastructure for sending SMS messages is inherently insecure. It just doesn't have a working security model. So that makes it worse than email based codes or or even the TOTP codes and stuff. It it is it is a twofer. So the fishing resistant is actually quite common that things aren't fishing resistant because it's much easier to answer the question what is fishing resistant and the answer is something based on pho2 either hardware pho tokens or pass keys. Those two are fishing resistant and pretty much everything else you can think of isn't. uh because if it involves a human typing into a text box, the human can be tricked into typing into the wrong text box. So, the way it would work is you get sent some sort of fishing link. You click the link and you don't look up to the address bar. You just look at the pretty pictures and it looks exactly like Gmail or like Office 365 or like apple.com or whatever it is you're trying to log into. Looks perfect. you don't know it's the address bar. It gives you the login box and you type in your username and password and you send it to the baddies who use your username and password on the real website. The real website asks them for a code. You get sent the SMS message. You enter it into your fake text box. They enter it into the real text box and now they're in. >> Okay? >> They can't stay in forever because they can't do this trick again. But they can stay in for as long as the website lets you stay logged in. And depending on what it is, that could be a long time or that mightn't matter very much. How long does it take to steal all of your money? You know, may maybe the 45 minutes you're allowed to stay signed in is sufficient to do significant damage. And lots of things have this problem, right? email based codes, SMS obviously, even the Google authenticator style codes which are technically called TOTP, timebased one-time passwords is what that stands for. They can you can also be tricked into putting those into the wrong text box. So SMS shares that vulnerability with the others. So the so the email the email codes are just as insecure except they're way more annoying because you have to sit there and wait for the mail to come in and go copy it and not have it autofill for you. >> Sometimes it'll autofill but usually not. >> I have two websites that force me to do it and they both autofill within about 3 seconds. I am very grateful to Apple for that. >> But the mail doesn't come in 3 seconds. these two organizations have managed to do that. >> Okay. I get it from all I get it constantly from probably I don't know 20 different companies. I mean it's not it's not a narrow field of people that are doing this. It's everybody's doing it. Claude did it the other day because I needed to I needed to go to the website versus being local on my app or >> it wanted oh prove yourself Allison. I shall send you an email. >> Yep. >> Yeah. I mean, it's not long, but it's like I'm right there. I've got my I sometimes I even have a 2FA code and it and it goes, "Yeah, but I'm going to send you an email. It's okay." >> Yeah. Just let me use the pass key, please. >> So, it's So, it's just as insecure as SMS as far as the squishy bits. >> Fishing. Yes. As far as the fishing bit is, SMS takes it up to another level because the actual sending of the SMS is horrifically insecure. So the TLDDR on this is that hacking the SMS system is not a technical problem anymore. It is now a an economic problem. You can go onto the dark web and simply buy interception of SMS. It is one of the many many crimeware as a service offerings available on the dark web. So you don't have to have any technical competence. So the only real question is, is the expected value of what is in the account more or less expensive than the price of buying access to someone's SMS messages? So if they're a big crypto influencer on Tik Tok who, you know, has a chunky big wallet full of lots of Bitcoin, the answer is almost certainly yes. If it's a, you know, you're a paying supporter to someone's blog and you get a episodes without without ads. No, that's really not worth intercepting. Unfortunately, a lot of places that still use SMS are banks, and banks do have something of value. So, that is most inconvenient. But really, it's a finance question, not a technical question. I think you've skipped over uh why SMS is insecure. >> You've jumped to the money part. >> Okay. You're on the next part title. >> Okay. >> Yeah. Does I mean it's an economics question is the first heading I have in the show notes for the reason that from the listener's point of view the why it's insecure. No, you're dead right. I've scrolled too far. I'm sorry. >> Okay. >> It is the main point though, right? But at the end of the day, if you don't care about the techy stuff, >> but what he asked was the answer. >> What he asked was is how insecure is it today? So why is SMS insecure? >> Yeah. Okay. So I'm going to use an analogy to explain the problem. So when our computers talk to each other, they're actually talking over IP addresses. Uh but you and I are not very good at IP addresses. So they we use DNS to map pretty names to those IP addresses. Cell phone numbers are supposed to do the memorable bit because what's actually happening under the hood is giant big identifiers that are permanently stuck in your SIM card, be it an eSIM or a physical SIM, your IM SI number, your Yeah. IMS SI, not IMEI. The EI is the phone. The SI is the SIM. And they're these giant big icky numbers, but we don't I don't know your IMSI, but I do know your cell phone number. >> So, how are those two together? >> With your stumbling around with IMEI various IMSI, I lost you completely. Are you saying that that your phone number is actually like a a name is to an IP address? It's a it's a a short phone number that goes to a longer number. >> Yeah. So, >> you need a longer number for the small one. >> Oh, no. The IMSI isn't small. The IMSI is this horrible big cloud. >> I know. I know. But if you can communicate with the small one, what do you need the big one for? >> But you're not really communicating with the small one. Like you're not really communicating with pot.com. >> Okay. >> You're you're there's a lookup happening to get from the small cell phone number to the real mechanism for transport, the IMSI. >> Okay. >> And that lookup is the equivalent of DNS. That lookup requires every cell phone carrier in the world to share information with each other. And the security of that sharing is as strong as the weakest ISP anywhere on planet Earth, including all of the poor countries that can't afford to upgrade. So the protocol used is ancient because there's cell phone networks on planet earth that are very very old and obsolete. So it is trivial to fake the mapping which means it's trivial to intercept people's SMS messages route them to a different IMSI for an error. >> Okay. So, some mysterious system behind this IMSI thing is what is uh ancient and creaky and insecure. >> Yeah. The DNS equivalent. I think it's called S7 or S9. Can't remember. >> Okay. >> But it's >> and we're and we're as weak as the weakest link in that. >> Yeah. >> Okay. >> Yeah. Because you can go anywhere in the world with your cell phone. So your cell phone has to work in Africa while you were over in Africa and it has to work in India when you were an Indian and it has to work in Antarctica or as close to Antarctica as it did work. I don't know how long it kept working but you got >> it worked pretty far down from for data anyway was surprising. >> So well we don't we have never talked about this before. I thought that the big insecurity there was again another fishing problem was the fact that I can uh call up AT&T and convince them to give me a you know somebody else's uh SIM card that you know get it reassigned to me. I thought that was the insecurity. >> You're right. That's a third that is a third weakness that I should have added to the list. Yeah. SIM jacking as that's called. >> Yeah. You trick the carrier into just putting your number on a different SIM card. That that is another way in which SMS is insecure. That's more noticeable than messing around with the IMSIs because you can muck around with the IMSI for an hour and then people may not realize. Whereas when you're SIM jacked, your phone will simply say no service. >> Right. Right. It it gone. >> It gone. Yeah. Which is going to get your attention. Whereas your SMS messages not showing up. I don't get that many of them. Would I notice? >> Nope. Yeah. Yeah. So, basically it comes down to the fact that if you're worth it, we can anyone can steal your cell phone number for an hour if it's financially valuable. But as Alistair said, any MFA is still better than none because any barrier to entry is still a barrier to entry. It may not keep everybody out, but it will keep a lot of things out. So, it's still worth doing. I mean, your front door lock is nowhere near Fort Knox, but it's not worthless, >> right? So, you know, right, we do have one deep dive, which is the same deep dive we've had the last two shows. >> So, I stopped you before you did your your whole SMS authentication is an economics question, though. >> I guess I'd sort of done that already. I sort of done it before you corrected me in my order. It it is purely down to is the value of breaking in more than the cost of breaking in. Like that's that's how all cyber crime works. If it cost me one penny to email a person and I send a million emails and I make a million dollars in profit, that's a good day. >> Yeah. I I don't think you did go through these steps that you have outlined here that you you okay. you walk through specific steps of how this works of how this uh >> Okay. >> Yeah. So, in order to be able to attack your second factor, the attackers do already have to have your first factor. So, that is that so your username and password need to be known because otherwise what's the value of getting your SMS message? >> Oh, right. >> It'll never get sent. >> Got it. Got it. Okay. But if you think of the amount of data breaches we report on later in the show here, that's nowhere near the barrier to entry it used to be. >> So >> yeah. Yeah. >> But but you're saying I'm just going to read the steps here. He says get your username and password like we just talked about. From that they determine your cell phone number that's available. They can track down what your phone number probably is. Then pay a fee to reroute your cell phone number to their SIM card. but only for an hour. >> An amount of time, right? The the longer you reroute it, the more it'll cost you. So, you're an attacker. You're just trying to break in. >> Oh. Oh. The fee on the dark web is is an hourly rate >> to steal your It's not permanent. >> Yeah. >> Well, to be honest, I've never bought it. I sort of assume it would be priced like that because everything in the dark is about making money. >> Okay. Okay. Okay. So, just rewriting the cell phone number for a while, but that's long enough to get in there and do all do all the work. Okay. And then you said that you can actually buy fully packaged soup to nuts offering. They get you all the way in. Um, fishing as a service provider. >> Nice. Nice. >> Okay. >> So, it's really it's impressive, but not in the good way. Right. Okay. So, our deep dive is the same as last time. And the same as the time before, more AI escapes have been disclosed because everyone's still looking back through their logs and going, "Oh, oopsie. We we messed up a long time ago without noticing." So, the first thing we've discovered is that OpenAI have admitted to more wrongdoing by some of their agents, but they didn't actually come out upfront. Instead, independent security researchers found that the agents had been misbehaving and attacking a German website, posted about it, and then OpenAI went, "Oh, yeah, that was us." But we thought that was an alignment problem, not a security problem. So, we didn't think we had to disclose that. >> Alignment problem. What's that? >> So, alignment is the paperclip problem. the the biggest problem in all of AI that the AI doesn't know what's evil because it doesn't have a concept of evil. And so to me, an alignment problem is a way worse problem than you've escaped from our lab. To me, the alignment problems are the one they should be notifying us about. >> Scary one >> more. >> This is a little kid keys your car and you say, "Oh, Johnny didn't know any better." >> Yeah. So what the researchers discovered is that rogue agents again had found yet another way to coordinate their activities behind OpenAI's back. So last time they were using OpenAI's artifactory repository within OpenAI's infrastructure to secretly talk to each other and retain memories between execution and stuff. Turns out this ability to to survive from one test to another is something these agents seem to be driven to do. And they had found a whole other way to do it outside of AI's lab on the actual public internet specifically on a German wiki about programming. And as the German cisadmins tried to reassert control over their website, the agents were continuously trying to outsmart the German cisadmins and they started to prefix their malicious pages with triple zed because the agents noticed that the cleanup was happening alphabetically. So yeah >> and I just read the summary from the hacker new or it's bits of it from the hacking news and hacker news and bits from peeping computer. The agents were using the site as a shared board to pull answers to a timed web task and pass around a way out of their sandbox. So they were sharing how to break out of OpenAI's lab on this German website behind OpenAI's back. The agents were supposed to have read only internet access but discovered they could write to an obscure German programming whippy wiki dse wiki or deutsche software and twickler German software developer. They turned it into a shared message board for pooling answers, cheating on tests, predicting future questions, and exchanging techniques for bypassing the sandbox. OpenAI's own wording suggests a wider footprint than the researchers have documented, describing the episode as one where our agents wrote to several internet sites is how OpenAI themselves described the incident when later presented with this evidence. So okay, Anthropic on the other hand proactively disclosed a fourth escape with some real world damage and this is a much simpler story. Uh basically the summary from the hacker news captures it perfectly. Entropic disclosed a fourth incident in which its artificial intelligence model broke into real third-party systems. Now, this happened in January, and it wasn't that the agents broke out of the sandbox. It was somewhat more embarrassing. Anthropic had done the equivalent of leave the cage open. They had forgotten the sandbox. So, >> that's why we can't have nice things. >> It's bone chilling. utterly like this is the equivalent of someone doing research on deadly flu and not having a properly working biohazard system. That that is what this feels like. A sort of a lace fair attitude to securing something dangerous and that's worrying. >> Yeah. >> Yeah. Now, just to cheer you up, don't worry. We There is happy news later on. I I kept it together for the end. >> It's not now, but >> it's not now. No, we're not done with this section just yet. Um, Anthropic have released their latest threat report into how their services are abused. So, this is their actual models that they've actually published already, not the scary stuff in the lab. This is the stuff in the real world that's being used for many things and abused. So the opening from anthropics report is actually just the best thing to read here to give you an idea what this is. Over the past 8 months, our threat intelligence team has identified and disrupted put a pin in the word disrupted. Disrupted operations in which threat actors tried to use Claude for malicious activity. In this report, we share case studies from those operations and describe how malicious code or malicious use of claude has evolved since our previous threat report in March, August, and November 2025. In each case, we disrupted the activity, used what we learned to strengthen our safeguards, and shared intelligence with authorities and industry partners where appropriate. Okay. The word disrupted may lead you to conclude that they prevented these attacks, but that's not quite what disrupted means. And when you read the rest of the report, it turns out that disrupted means caught them having done really bad things and stopped them doing more really bad things. Obviously good to stop them doing more. But this isn't a report of what was prevented. This is a report of what was discovered and then stopped. So, it did happen. And a lot of the stuff is what you would expect, right? Cyber criminals making convincing fishing lures using clouds on mass. Those kind of things you expect. Uh malware, asking it to write malware, finding ways to trick it into writing malware, all the kind of things you'd expect. What's a little bit less expected was a successful incident where they managed to get clawed agents to scan 1.8 8 million distinct Android apps looking for hardcoded secrets inside the published APKs and streaming every secret discovered into Telegram channels in 100 or over 100 different categories. So they had a 100 different channels in Telegram, one for each category. And every time they got like, oh look, here's a GitHub key, it goes into that channel. Oh, look. Here's a key for some other API in AWS or something into this Telegram channel. And they were just hoovering these up on mass. 1.8 million apps scanned before Anthropic noticed and nipped it in the bud. And the other thing that caught my eye is it's not just the cyber criminals. It is Russian and Chinese state actors. In other words, hackers acting on behalf of those governments are also using clouds to attack us. Frankly, the Western world is being attacked by our own giant big AI companies inadvertently, which is interesting. They are paying for it though. So, >> okay, good. I mean, as long as some billionaires are making money, we're we're okay. We're good. >> Yeah. And I I do think it's really good that Anthropic actually released these threat reports, giving us a real understanding of how these systems are abused, but I don't feel that they are taking enough time to actually lock these things down before releasing new things. But you are free to read the report and judge for yourself whether they're going too fast or not. But that is my takeaway from this is that okay, so you know how much your current models are abused. You have more work to do to lock this down, but rather than pausing and locking it down, you're off doing the next one already and the next one already. And I'm not sure that's the most responsible use of resources. >> This is still depressing, Bert. >> Yeah. Um, in related news, Chachbt6 Astra is better at cyber security and more difficult to monitor. So, this is a very interesting one. So, chat TPT6 Astra is the first model OpenAI have selfcertified to reach its critical threshold for cyber security. under OpenAI's own framework, a model that reaches the critical cyber security threshold. Uh it if it can identify and develop functional zeroday exploits of all severity levels in many hardened realworld critical systems without human intervention or devise and execute new endtoend attack strategies against hardened targets. So JCP or uh OpenAI have this definition of what counts as critical and they've just released their first ever critical model and it means it can do these really quite scary things. Open AAI has strengthened Astra's jailbreak resistance good uh isolation checkpoint encryption monitoring and internal deployment controls. So these are all good things to harden. The company also claims Astra is better aligned than GPT 5.6 SOL, meaning it is less likely to overreach or violate safety and security boundaries. So that's good. Um, alignment is in my opinion the biggest problem here. So if it's less poorly aligned, that's good. One of the more unusual findings is that Astra appears better at controlling what it reveals in its own chain of thought. That's less good. Chat GPT's monitor has decreased relative to GPT 5.6 Saul. Open AAI acknowledged in tests. OpenAI found that Astra could sometimes hide strategically poor performance and avoid internal monitors during certain sabotage tasks. >> Is that what I >> That's an interesting mix. >> Yeah, some of these appear as quotes in the in your coverage, some are not. >> Okay. So, beeping computer are quoting OpenAI whenever there's quotation marks inside the big block quote. >> I see what you're saying. Okay. >> Yeah. So, I basically I summarized the Bleeping Computers overview of the release by OpenAI. And I'm doing that a lot with these AI stories because if I paraphrase someone else paraphrasing, I'm just afraid I've missed something. >> All of a sudden, you're playing telephone, right? >> Yeah. >> Okay. So, this is all >> So, that's starting to sound like turning into noise to me as as you've been describing these things. It it basically sounds like the end of times. >> It sounds like we should be taking some serious action here. >> Who didn't all the AI heads get together and say yes, somebody should be taking action here? >> They had a meeting. >> They say somebody should not not a we will. >> Yeah. >> Yeah. It's the end of time, Spart. I mean, >> I don't know. It's it's it now to some extent this is us learning more about what's already happened before. So we were kind of here already but oblivious and now we're less oblivious. Not sure that makes me feel a whole lot better. >> Yeah. >> But anyway, here we are. >> Yeah. >> All right. Action alerts. These are things you can do things about. Generally speaking, the same thing. Patchy patchy patch patch. Uh patch Tuesday was a whopper. 966 flaws fixed. >> Wow. >> Only two zero days. It's a small number of zero days comparatively. But yeah, this AI thing is finding quite a lot of bugs. Um as I Apple have released iOS 26.2, iPad OS 26.2 even though they're getting very ready to release the 27 OSS. Nonetheless, you should patch to those most recent iOS and iPad OS versions as soon as you can. If you run the Telegram desktop app, just be sure it is patched. There's an issue that allows poisoned messages to steal exported chat histories, which is a very weird bug. It was patched back in July. So, if you're vaguely up to date, your your app is not currently making potentially dangerous exports. But no matter how patched your app is, everything you exported before could still be dangerous because the way this attack worked is that someone who was malicious could send the chat message into a conversation with hidden JavaScript and when exported to HTML, every time you view the transcript, it uses JavaScript to send the entire transcript to the attackers, allowing them to effectively spy on you. What is an exported chat history? I mean, where are they stealing them from? >> So, if Okay, so you imagine you're in a big conversation and you save it to an HTML file using Telegram's export feature. >> Okay. >> Opening that HTML file will make your browser send a copy of the entire chat, the entire HTML file to the bad. built into the X file in in the unpatched versions >> is sending. So >> the desktop app has been poisoned. Not poison messages. >> The app itself has been poisoned if it's creating an an HTML file that sends a message to somebody. >> No, no. The app fails to strip out the JavaScript. So someone has to send malicious JavaScript. The app is supposed to stop the malicious JavaScript getting into the export, but it was failing. So if someone sent one malicious message anywhere in the export, >> not in the export, in the in the message, they'd have to be in the message >> like >> in the messages being exported. >> So you and I are chatting. You insert a a this malware into the this JavaScript in our message thread. Then I export it. Then I open it up on the web and then it sends something somewhere. >> Yeah. So anytime any browser opens that HTML file, it uses JavaScript to send a copy of the trans. >> You have to have sent me JavaScript in our text message conversation on on Telegram >> in Yes. So if you export, say all of your Telegram history and one message anywhere in any chat you exported has this malicious JavaScript in it, the old version of the app didn't spot it, didn't strip it out, and then all of your chat in that export would go to the attackers. >> Okay, so again, someone has to send me a message with that malicious JavaScript in it. >> Wow, this seems obscure, but okay. If you're the kind of person exporting messages, it's probably good to know that your old export should be thrown away. Just export it again. Just, you know, do that. Okay. Um, Chrome users, be sure to do that trick where you turn it off and turn it on again so that it updates itself. Um, there were two zero days fixed just a few days apart. So, if you turned it off and turned it on again when you read the news about a zero day and then 3 days later you thought you read the same news again, it's actually fresh news and you need to turn it off and turn it on again. >> Wow. >> Um, Plex users, you would have gotten an email from Plex telling you without giving away any details that you should really patch your server very very soon because there's a really really nasty problem. >> I did not get a message from Plex. >> Oh, okay. I did. I wonder. That's interesting. >> Either way, make sure your Plex is fully patched because as of a few days ago, there were 36,000 unpatched Plex servers sitting on the public. >> Well, if they didn't tell me, I'm one of them. >> I would be Well, but don't you use Tail Scale to keep yourself safe? >> I don't know what that has to do with my Plex server. Well, if you don't expose us to the internet, unless you're on your tail scale network, then you'd be okay. >> Yeah. Doesn't Plex have a way of getting around that? I don't remember. It's been a long time. >> It depends on whether you turn on the getting around. So, you can make Plex available to the world or you can make it that you need to be >> I know Lindsay uses from her house and she's not on our tail scale network. So, I must have some sort of way to get in. That's really interesting. >> Yeah. Patchy patchy patch patch. You have to be opening Plex to get the No, you said they sent you an email. >> H >> Yeah, I I got an email in my inbox and then I saw it on Bleeping computer. >> All right. >> About an hour later. >> Um yet another time to make sure your WordPress is getting its plugins updated. There's a very popular plugin called All-in-One WP Migration and Backup. Really, really, really serious vulnerability. I think it was a 9.8 out of 10. So, if you use that plugin, you really do want to be sure that you're absolutely patched. And if you own a Microick router, you need to patch immediately as well. There is a patch, but you do need to do it. And Microick are very popular nerd router. So, there you go. Worthy warnings. Then I have we have mentioned before a few months ago that there was a rise in people stealing physical Apple gift cards and basically taking the money and then revering them so that when you scratch them off again they're now already used and if you use them in your Apple ID you could end up being done for fraud. But this is now a massive problem and it's it really is a reminder that those scratch those scratch cards you just can't safely buy them in a in a physical store because anyone could have scratched them already and resilled them. Uh there is an organized crime group doing millions through this millions of dollars. Android users, the baddies have found another way to get around the fact that Google are tightening the rules on their Play Store. Google Play have a thing called early access, which is very like um Test Pilot, is that what it's called for Apple where you can have apps that are not in the store yet still available? >> Test flight. I knew I had it wrong. Thank you, Allison. You should know. You've been a recent uh >> user. I was using it because I was I was beta testing your apps. But anyway, um basically this early access program is in the real app store, but it's not listed in the app store. And because it's not a released app yet, user reviews and user comments are disabled. So all of the usual signals people use to warn each other about dodgy apps are intentionally disabled. So, if someone sends you a link to one of these pre-reviewed apps, you do have to have the link, but that's should just be an immediate red flag. Unless you're working with a someone who you know is a developer who you trust, you shouldn't do anything from the early access program. It's almost certainly a scam. If you traveled through Vietnam, to Vietnam or through Vietnam, any time between 2017 and 2026, you need to be aware that your data has been leaked. Um, that is your date of birth, your flight details, your travel. >> Anybody who traveled through Vietnam, did you say? >> Yes. It's the database used every time they scan your passport and stuff to enter or leave the country. They lost it. Oh jeez. We're not sure how. They're not being at all open about the how, but it was found on the internet on a database without a username and a password that someone accidentally left exposed. >> Oh man. Wait a minute. Wait a minute. Yeah. >> I just noticed you said 2017 to 2026. >> Yes, I did. >> Cool. >> Yeah. Cool. Cool. So if someone is able to convincingly tell you your passport number and you were it through Vietnam, don't assume it's legitimate because anyone can now have this information and look very convincing. They would know what airline, what flight, and your passport number, which could become quite convincing. If you use Skull Candy earbuds, there is a flaw that lets nearby attackers effectively pair without permission, turning the microphone into an easedropping device. Um, basically, you just need to not use them in a situation where that's a problem. Um, as summarized by Bleeping Computer, owners of affected Dime 3 earbuds should therefore be cautious when using them in public or other environments where unknown devices may be within Bluetooth range. How to use a microphone as an eavesdropping device? You would think a micro I could see a speaker, but a microphone is the the iny part, not the audi part. >> Right? So, they're trying to use your headphones as the ini part to listen to what you're saying from another room. They're not in your room, but they're in Bluetooth range. >> They have your microphone going to their device, not to your device. They're now eavesdropping on you. >> The microphone is the part you talk to, not the part you listen to. How could they listen through a microphone? You can't hear me coming out of this microphone. You hear me going into the microphone? But right but your computer is connected to that microphone and is recording that audio. >> So the output of the microphone the output of the microphone then >> right. Yeah. So they've paired to the microphone. So your microphone is connected to their device. >> Okay, I got it. Yeah. Yeah. Like I say, there's nothing you can do other than just be aware. So for most people most of the time, not a big deal. For some people like lawyers and doctors, you can't use those for talking to patients. You're going to have to use different pair of headphones. Uh if you own an LG TV, just don't connect the smart bit to the internet because it's basically spying on your house. So we have dis attack or security research have discovered that it scans your network to see what you own and reports it back to LG to update your profile so they can sell you to advertisers. >> They were supposed to be one of the good ones. >> I my theory has been use an Apple TV and don't let any television made by anyone touch your home network. I stand by that advice. >> Yeah. But I thought I thought LG was one of the ones that wasn't as bad. But maybe not. Cool. It's not malware. Some of them were sending actual malware because they weren't noticing or they were really being malicious. So, they're not the worst, but just don't connect your telly to your network. I think that's the answer. And then the last story broke just as I was writing the show notes. Details are still emerging. It would appear that the Florida DMV have lost hundreds of thousands of driver records. Again, no notifications to affected users yet because everyone's still trying to figure out how bad this is. The attackers say 200,000. The DMV are not putting a number on it, but they have engaged experts. If someone contacts you and they know your driver details, just be a little suspicious. It really could be targeted fishing. >> Okay. Right. Have fun soon. God, that was really horrible. >> This has been a bad >> Yeah. Yeah. This This is This is not a And I What listeners don't know is this this episode is a bit unusual cuz I have a family thing. So, I didn't write these notes at once. These notes were written over the space of a whole week as short little commits. I had no idea how depressing these notes were when held together. I wrote these stories one by one. Okay, I'm I'm just going to go put my head in a bucket of water at the end of this. >> No, no, no. You're good. You're You're good. Okay, so Apple intelligence, audio intelligence is coming to Apple stuff with the new Apple watches and people are worried about the privacy concerns because of things that have happened with products from other companies. Before you go too before you go too far, again, this is the like how your watch will uh transcribe the last 15 seconds because you missed the waitress reading you the specials and the fact that you can go back uh you can actually tell it to record. Is that what you're talking about? >> Those are the two features. Yes. So, we'll talk about them in a little bit more detail. >> I didn't want you to talk about how it's done until you told people what it was. That's what I was trying to stop. Okay. >> Yes. Gotcha. Cult have a good article explaining the what and why this is not a privacy train wreck. Apple have very carefully thought about this. So the most important thing is this is listening to audio but it's not giving you audio files out. It's not recording stuff. It's giving you only transcripts and all of the processing is happening on separate hardware. So Apple have created the secure exclave which is a separate chip. So a software bug in watch OS can't access this data because it's in a different physical chip. That's why it's called a secure exclave. So this is like the secure enclave for protecting your private keys for Face ID. Same idea, but it's a secure exclave for keeping stuff out of reach of the core operating system. So Apple have put hardware here to stop this becoming easedropping. So that's amazing to do that in hardware. The raw audio doesn't come out of the exclave. So there is just no access to the audio. That audio just effectively is unsavable. You can't do it. Apple can't do it. It's in the exclave. You can't save the audio. So it's not an Easter. >> But it is saved. Just not by you. >> No, only the transcript is saved. It's it's a loop. Okay. It's like a it's like a continuous piece of 15 that's recording over itself. >> That's the 15-second one then. They're both using that loop. The other one is outputting a transcript, but the audio, the whole audio is never saved. The transcript is being built from the loop. >> What? What loop? Cuz it's not writing over. >> Okay. Well, so in the inside the exclave, it's constantly writing over the last 15 seconds it's recording. >> Oh, last last 15 seconds audio. So it is recording audio but it's writing over >> even even the long form one is writing over the audio. >> Yes. >> Okay. >> Yes. >> Okay. >> Yes. It's streaming a transcript. Think of it as a streaming transcript. >> Yeah. But the transcript has to come from something. So that that loop piece was important. Okay. >> Yes. Yeah. Okay. Uh none of the features attribute the audio to specific human beings. So when you do that, tell me the last 15 seconds. It doesn't know who said it and even if you ask it to summarize a meeting for you, which you have to turn on in advance because otherwise it's lost. Uh it tells you contributor one and contributor two, not Allison and Bart and Steve. So again, there's no way to tie it to specific human beings. >> I don't know. You know what I do with my uh uh transcripts from um we take the audio from an interview at CES on a loud floor and I I uh tell an AI the two people are talking are Bart and Allison and from the uh from the text transcript alone it figures out who's who who's talking. It puts the it puts the names on it like the the the AI never got the audio. All I I described it poorly. I take the AI create get a transcript of it. Then I feed the transcript to an AI and it tell it tell it it's Bart and Allison and it figures out who it is. There can be three people and just from the context it gets like 85 90% correct. It's crazy. >> Sure. So it's recognizing it's the same person but it's not tying it to a specific human being. You're tying it to a specific human being. So it's not a privacy reason. No, no, no. I'm telling it. Two people were talking. >> Their names were Allison and and Bart. Figure out who said what. >> Sure. But the point Apple are making is that you can't walk through a room and start to say this complete stranger over here >> is Tom who's so and so on Facebook. >> Right? There's no connecting it to human beings. You can say that participant one is Allison and partip part why can't I say that word participant such a simple word this is my rearw wheel drive hi buddy >> okay so that cool >> the recap yeah so the recap feature produces a summary of the transcripts of the recording so you can't even get a a transcript out of the recap. Recap the long form. >> We only get a summary. >> We got to keep explaining what we're talking about because I don't I don't think people we don't know what the names of these things are yet. >> Uh no, we do. The 15-second one is live rewind and the long-term one is recap. >> Siri Recap. >> They're the two brand names. >> Okay. A federal judge has decided not to break up Google. Oh, >> can we I'm sorry. I thought there was going to be more to this. My understanding is that uh that the summary actually goes to uh God, what was it? This goes over to the phone and then that it goes from the phone then it goes off to um private cloud compute to do more uh more work on it. Okay. So not not yet partially you're right about the phone, you're wrong about private compute. So it doesn't go to private compute. It explicitly never goes to the cloud. So there's an there's a secure exclave in the iPhones and there's a secure exclave in the Mac. And those two secure exclaves share information. >> Watch part. Where do you get the Mac? >> Sorry. What? >> Sorry. Sorry. Sorry. Wrong word. Wrong word. Wrong word. Phone and watch. They are the only two participants in the conversation. And both of them have secure exclave chips. And those two chips are exchanging the data for help with each other. But the actual core chips in the phone and the watch don't get the data. It stays in the exclaves on but it is on two local devices. But it doesn't leave your devices. It doesn't go to private cloud. >> Okay. I'm going to double check that because I that's what I thought I heard on on ATP, but I'll I'll jump back in if I find out uh otherwise. >> Okay. Okay, so the big question has been since Google are officially monopoly for the search, what will happen? And everyone thought, oh, they'll break them up or rather the government said, please break them up. No breakup. Uh there are going to be behavioral changes and that's all we know because the proposed changes have been given to Google and the government and they now have some time to comment and then the judge will tell the public what the final outcome is. Um, Mulvad, who are a company that some of our listeners use, >> it's a VPN company. >> They had their own. >> Correct. Yes. And they also had a private DNS service of their own that they were also running as like a a bonus extra for their VPN customers. They are ceasing to run their own DNS and they are instead helping to finance the Quad 9 secure DNS service which is one of the ones that we have recommended over time. Here 1111 from um a lot of extra ones 1111 >> was it? Oh, I'm sorry. >> Like 11 of them. Um, so yeah, Molad are going to support Quad9 and they want their users to switch to Quad 9, but you do actually have to do that otherwise your DNS is going to break if you don't listen to that message from Mulvad telling you to stop using their DNS. And then we get to the nice cyber security improvements. Tour are bringing appspecific VPNs to Android. So you can have any app be shoved through the tour network for extra privacy and encryption. Interesting idea. Android has provided a secure mechanism for changing from one password manager to another. And it will allow you to transfer passwords and pass keys without that risky export to plain text that you would have to do if you do it manually. So, if you're manually switching from one password to Apple passwords, you export from one password into a text file or CSV file or something and then import into Apple passwords or whatever. While on Android, the OS can broker the two and avoid that risky plain text exposure. So, that's a really nice feature. So, I'm happy to see Google offer that to Android users. And speaking of 1.1.1, is that enough? >> Yes, that's right. I think Now I have to count. Um, they are upgrading the encryption on their secure DNS to be postquantum. So you can have quote postquantum secure DNS from Cloudflare at 1.1.1. >> That's fun. >> All right. This just in. >> Yeah. >> On the Apple's audio intelligence privacy overview PDF, it says uh secure ondevice transcription on the watch just like what you were talking about. Uh, it's decrypted inside the secure enclave on the paired iPhone and it creates a transcript that's half the size of the original and then it sends it to private cloud compute to summarize the text. >> Oh, okay. So, the audio never leaves your device. So, that the audio is local. >> Yeah, the audio is permanently deleted. >> So, the summary of the trans No, wait. here. >> You know, it's already a summary. It's a summary of the transcript is sent to private cloud to be summarized even more. >> Yeah. So, uh here we go. The secure enclave on Apple Watch encrypts the audio, transmits it to the secure enclave on the paired iPhone. Uh at that point, the audio is deleted on the Apple Watch. Um okay. And then the encrypted audio is decrypted inside the cure secure exclave of the paired iPhone. Ondevice speech recognition transcribes the audio to text. Then an ondevice language model generates a condensed version that is less than half the length of the original transcript. Uh keep going down then this condensed transcript is uh encrypted and sent to private cloud compute. Contextual information is also sent to improve summary quality. Uh then there's a bunch of details about it what it does with calendar data and things like that. Uh, Apple Foundation models running on private cloud compute. Generate a title and a summary with key points. That's your Siri recap. The finished textbased summary is encrypted, sent from private cloud compute back to iPhone and Apple Watch where it's available to view in the Siri app in the recaps tab. So the transcript is happening locally and then the turning the raw words into a useful summary with headings and key points is done in private. >> Well, first is first the transcript is cut less than in half into a summary level and then it goes off to uh private cloud compute where it becomes summarized more >> and organized pulling out key points >> and a little more faffing about that. I don't understand where they they're talking about grocery store and park. I don't know what they're talking about at that point. I lost track, but I could put a link to that in the show notes. >> Do please. That is Yeah, I do like that Apple are very open about this. And even private cloud compute, by the way, is proven cryptographically secure. Apple do not know what you're doing in there. It is that that is provable and verified by external researchers. So that is proper end to- end encryption. So Apple are taking this seriously and telling us how which is also nice. >> Right. Pallet cleansers. Allison, I'm going to give you one because you put me on to this and I just think it's too cool not to mention. So, the Nancy Grace Roman Space Telescope is an amazing space telescope just from a science point of view, but it's the first one they've called after a female scientist >> and she's considered she's considered the mother of Hubble. >> Yeah. She she had a you know she was the first lead astronomer in NASA and her big idea was a space telescope and she did all the conceptual hard work which is why she's considered the grandmother of the Hubble like that's amazing >> uh mother of Hubble I don't think I don't think grandmother of Hubble but uh yeah >> mother of mother of hub >> so then can I tell the what I found >> you can adopt a pixel There are apparently enough pixels that if you have to you can only get one per email address, but if you have more than one email address, maybe you could get extra pixels. But you can adopt a pixel from the Nancy Roman Grace uh Nancy Grace Roman telescope and you get a number that it tells you where your pixel is. Well, initially I was like, "Oh my god, I got to get a pixel quick." And then I realized how many megapixels this telescope has. There are not enough humans on planet Earth for there not to be enough. >> But I still my friends, we were trying to get all ours near each other, so we did them all at the same time. >> Oh, so I actually stuck another one in here and I'm going to describe this woman first who's doing these videos as a woman on Tik Tok who is a senior platform engineer and she's absolutely hilarious. She does it's a classic thing on Tik Tok where somebody plays more than one part. uh they they argue with themselves or you know there's a physicist I watch who explains astronomy to himself. Uh but this one I I put a link to this and and you do need to have Tik Tok to get to it or at the very least you have to put in your birthday, but you can lie. Um it's it's her going a bit too far with AI. That's all I'm going to say. It is absolutely hysterical. She's uh a bit addicted, but it's super nerdy and super awesome. She's really She's really great. Excellent. Well, I have three. Um, designed in California is a new podcast from Jason Snell and Mike Hurley. It is inspired by the rest is history, which is an award-winning podcast that I think Apple named it podcast of the year, which is when I discovered it. And I can't remember if Steve discovered it because I discovered it or or if we both discovered it because Apple made it the podcast of the year, but myself and Steve are both giant big fans of the rest is history. Imagine that same style, but the history is the history of Apple. And it's Jason Snell and Mike Hurley who really do know their stuff. So they've produced these amazing episodes. And if you backed that on Kickstarter, you get each series in one big go without ads. So, I have all seven episodes of the first series, but other people I think you're on episode three, everyone else who's listening for free. It's really good. It's really good. I am learning so much about how did you know Mac OS 10 was almost based on Windows XT? XP, >> not XP. NT >> at least contenders. H you know those w it's fascinating absolutely fascinating I learned so much so that was anyway really want to recommend that show um a video because it's just hilarious uh modernday typographer so if you like musicals you may have heard of HMS Pinnhaphor which has a very famous song about a modern major general imagine that song all about typography It's hilarious. >> That's not nerdy at all. Bart. >> Oh, it's Cordova. Of course it is. >> Of course. >> Or El Cordova. Sorry. >> And recommended by John Gruber, who's the ultimate typography nerd in my No, Glenn Fleshman is even more of a typography nerd. Either way, it's brilliant. I really, it's so good. And then I have a software recommendation. This is a Safari extension called Litterbox. And I cannot summarize this better than the developer. I made Litterbox, a Safari extension to open x.com links in a pop-up. The idea is you open it, you look, gag a little, and then close the lid. Litterbox doesn't send your cookies when you open those pop-ups. It uses the same API X uses for its web embeds. I don't think they'll kill the website embed feature, but if they do, it'll be very funny. >> When you were recommending any way to to look at X, I was like, "What's wrong with you, Bart? Why would you even do that?" But I love that. I love that description. Um, but somebody once told me not to add any more extensions to your browser than you actually need. So, I think I'll avoid it. But I do I feel like sending the guy money just for his comedy. Yeah, I I honestly I've installed it because there's links in I have to open X links for the show notes sometimes because people say things on X that are important or important people say things on X that might be important. And the way this works is there's like stink lines appear when you have the plug-in running and when you click the link you get the little popup and then you just close it and you never have to open X and you can see what the >> X message said. Do we still call them tweets? >> I don't know. I I don't I don't open it. >> Well, that works, too. Okay, that's all she wrote this time. Um, sorry there was so much bad news. Thank goodness. I didn't know how depressing I was going to be. >> We needed them this time. That was definitely necessary >> indeed. But remember folks, no matter how weird things get, one message is going to stay the same. Stay patched so you stay secure. Well, that's going to wind us up this week. Did you know you can email me at allisonpodfe.com anytime you like? You should know that if you have a question or a suggestion, just send it on over. Contributions like Eddie Tomcoys. Anything you got, it'd be fun. Remember, everything good starts with podfeed.com. You can follow me on Masttodon at podfey.com/mastadon. If you want to actually see my podcast work on YouTube, you can go to podfeed.com/youtube. If you want to join the conversation, you should join our Slack community because it's super fun over at podfey.com/slack where you can talk to me and all the other lovely noilic castaways. You can support the show at poty.com/patreon with a onetime donation at podfey.com/donate. There you can use Apple Pay or any credit card. No sign up, no nothing. Or you can use PayPal at poty.com/pappal. Or you know what you could do? You could use one of my referral links like our lovely anonymous noilic castaway. And if you want to join in the fun of the live show, you're going to have to wait until September 27th to head on over to podfeat.com/live on Sunday nights at 5:00 p. p.m. Pacific time and join the friendly and enthusiastic Nosil Castaways. Thanks for listening and stay subscribed.