jsr

Chasing digital badness at the citizen lab. All words here are my own.

Public Key

npub1vz03sm9qy0t93s87qx2hq3e0t9t9ezlpmstrk92pltyajz4yazhshfttwj

NIP-05 Address

Profile Code

nprofile1qqsxp8ccdjsz84jccrlqr9tsguh4j4ju30sac93mz4ql4jwep2jw3tcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsrm7gxt

Publishing to

atlas.nostr.land

relay.damus.io

nos.lol

Author Public Key

npub1vz03sm9qy0t93s87qx2hq3e0t9t9ezlpmstrk92pltyajz4yazhshfttwj

Show more details

Last Notes

2026-03-03 00:55:51 UTC

We're about to see a new surveillance trap: "Plaid for AI"
This will look like slick middleware that seamlessly hooks CRMs to Claude, gmail to GPT-5 etc, etc.
UX will be great & founders well-meaning.
And then the VCs will ask: what else can we do with this sick tokenflow data?
And so a new generation of founders will rediscover fire: the data they route is more valuable than fees they get for routing it.
Spoiler: Your ISP discovered this. And now sells your data. Financial services companies discovered this. And now sell your data.
AI middleware companies are next.
Because if they're routing data to inference providers, they get seeing who is querying what, when & how. Unprecedented window into thought process, tool calls, proprietary workflows.
Already a scarce, valuable resource mostly available to the big inference providers (key part of their moat!). Only going to be more so.
But it also smells like commercial insight, business & market intelligence for days...
So, you build in surveillance and monetization becomes your big defensible margin.
And then one day the warrants arrive... Or maybe you've been clever and, despite some founder discomfort that the VCs pushed through, you just quietly built a for-government dashboard during your Series C...

2026-02-09 21:08:11 UTC

They showed us cute missing dogs & we consented to opt into a mass human tracking system.
I think Ring's wants to be Flock. On steroids.
Because instead of just sketchy cameras in parking lots, Search Party will cover your own backyards & homes.
https://blossom.primal.net/e4d0c92c8190d6d808b4f1d54e06031e1358d317344aa71d1809f7403f253c04.mp4
And if you & your neighbors want to challenge the loss of privacy? Well, how exactly would you do that effectively?
Because, instead of going to the city council, looking at the contracts, and calling out your mayor for speeding your city to dystopia, it's massive and distributed.
Will you even know which of your neighbors is now helping to feed the system?
If we had half competent privacy regulators & laws in the US this kind of thing would be a big, hard fight for Ring.
Instead? It's a Super Bowl commercial.
Oh, and yeah Ring has already partnered with Flock Safety to incorporate tools letting the government directly request footage

2026-02-04 15:15:54 UTC

I TRUST YOU BUT YOUR AI AGENT IS A SNITCH: Why We Need a New Social Contract
We’re chatting on Signal, enjoying encryption, right? But your DIY productivity agent is piping the whole thing back to Anthropic.
Friend, you’ve just created a permanent subpoena-able record of my private thoughts held by a corporation that owes me zero privacy protections.
https://blossom.primal.net/220613c4d3889e2403ef4c836490cefbb81822b190b270076e289d2a2e057a85.png
Even when folks use open-source agents like #openclaw in decentralized setups, the default /easy configuration is to plug in an API resulting in data getting backhauled to Anthropic, OpenAI, etc.
And so those providers get all the good stuff: intimate confessions, legal strategies, work gripes. Worse? Even if you’ve made peace with this, your friends absolutely haven’t consented to their secrets piped to a datacenter. Do they even know?
Governments are spending a lot of time trying to kill end-to-end encryption, but if we’re not careful, we’ll do the job for them.
The problem is big & growing:
Threat 1: proprietary AI agents. Helpers inside apps or system-wide stuff. Think: desktop productivity tools by a big company. Hello, Copilot. These companies already have tons of incentive to soak up your private stuff & are very unlikely to respect developer intent & privacy without big fights (Those fights need to keep happening)
Threat 2: DIY agents that are privacy leaky as hell, not through evil intent or misaligned ethics, but just because folks are excited and moving quickly. Or carelessly. And are using someone’s API.
I sincerely hope is that the DIY/ OpenSource ecosystem that is spinning up around AI agents has some privacy heroes in it. Because it should be possible to do some building & standards that use permission and privacy as the first principle.
Maybe we can show what’s possible for respecting privacy so that we can demand it from big companies?
Respecting your friends means respecting when they use encrypted messaging. It means keeping privacy-leaking agents out of private spaces without all-party consent.
Ideas to mull (there are probably better ones, but I want to be constructive):
Human only mode/ X-No-Agents flags
How about converging on some standards & app signals that AI agents must respect, absolutely. Like signals that an app/chat can emit & be opted out of exposure to an AI agent.
Agent Exclusion Zones
For example, starting with the premise that the correct way to respect developer (& user intent) with end to end encrypted apps is that they not be included, perhaps with the exception [risky tho!] of whitelisting specific chats etc. This is important right now since so many folks are getting excited about connecting their agents to encrypted messengers as a control channel, which is going to mean lots more integrations soon.
#NoSecretAgents Dev Pledge
Something like a developer pledge that agents will declare themselves in chat and not share data to a backend without all-party consent.
None of these ideas are remotely perfect, but unless we start experimenting with them now, we're not building our best future.
Next challenge? Local Only / Private Processing: local-First as a default.
Unless we move very quickly towards a world where the processing that agents do is truly private (e.g. not accessible to a third party) and/or local by default, even if agents are not shipping signal chats, they are creating an unbelievably detailed view into your personal world, held by others. And fundamentally breaking your own mental model of what on your device is & isn't under your control / private.

2025-10-17 10:15:59 UTC

NEW: 🇰🇵DPRK hackers have begun hiding malware on blockchain.
Result, decentralized, immutable malware from a government crypto theft operation.
https://blossom.primal.net/a107de401a522d0914a28dec26d00b96e8444e3d25259e14cfaa04a023b098b4.png
It only cost $1.37 USD in gas fees per malware change (e.g. to update the command & control server)
https://blossom.primal.net/4ba1cadacaac86882f3363c59e5320db53dd97c6a53fe5a689e49387e81eaa36.png
Blockchains as malware dead drops are a fascinating, predictable evolution for nation state attackers.
https://blossom.primal.net/29d96437b500d63006608b3bba6fdf5ae776c29ff697dfb7485b7aafbbbe38e7.png
And Blockchain explorers are a natural target.
https://blossom.primal.net/4a0cb4b61499359f7d3048d03000f6cce432c7211615a8029f1f7515c379de35.png
Nearly impossible to remove.
https://blossom.primal.net/816dce991b4bd694b9def92d508ae5c35f77df7fd13627ebeb5c8f223e538407.png
Experimentation with putting malware on blockchains is in infancy.
Ultimately there will be some efforts to try and implement social engineering protection around this, but combined with things like agentic AI & vibe coding by low-information people...whew boy this gold seam is going to be productive for a long time.
Still, where here they used social engineering, I expect attackers to also experiment with directly loading zero click exploits onto blockchains targeting things like blockchain explorers & other systems that process blockchains... especially if they are sometimes hosted on the same systems & networks that handle transactions / have wallets.
REPORT: https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding

2025-10-06 15:39:06 UTC

Only four fire department callouts?
Clearly the Asian market isn't stocking enough durians.
https://blossom.primal.net/acccaf548a46746ce45c1ba1bacc51e620cf1cb7e86d5e57ccc1d83219172ba9.png
Durian is one of the only fruits where your nose can tell you if it's in stock before you get near the section.
https://blossom.primal.net/de46b27f37b3b39f7868d756424918e5e71f6b66bf716070c159636f9b39a885.png
Also, I disagree that Durian smells of gas. It smells of sweet old wet socks and vanilla ice cream.
https://blossom.primal.net/dfa0de5167e358c0056c92a8972f7207db72f7e0981cc88521331e40d80e895e.png

2025-09-12 12:45:32 UTC

Friend,
If scrolling leaves you feeling hollowed...
If anger is frictionless and thinking feels like fighting the current,
You're not swimming, you're being swept in an algorithmic rip tide.
And your mental clarity is the target.
So, take a beat and step out
Put the thing down.
Connect with your own thoughts.
It's what the designers of these algorithms fear most.

2025-09-02 10:07:45 UTC

NEW: foreign mercenary spyware is coming to the US.
ICE just quietly unsuspended contract with spyware maker #Paragon.
They got caught this year being used to hack journalists.
Friend, let me me bring you up to speed on why this is bad on multiple fronts.
https://blossom.primal.net/9149c1061b8c41d34f95e36d74f9197bffaaeca0d854081bf16ad63cbde6e22f.png
YOUR BACKGROUND BRIEF:
#Paragon was co-founded in Israel in 2019 by ex head of Israel's NSA equivalent (Unit 8200) w/ major backing from former Israeli PM Ehud Barak.
Pitched themselves as stealthy & abuse-proof alternative to NSO Group's Pegasus.
https://blossom.primal.net/20174dc33c0dfd6b2e621b62621d0ed0d672acde5a2db5ac5e74a93eda49714a.png
The company has been trying to get into the US market for years.
For a long time all we knew about Paragon was their performance as a 'virtuous' spyware company with values.
https://blossom.primal.net/5255146af326cbbd9240db89a6ec67a8b298bae0f91d897ec1161573e19363a7.png
All that came to a crashing halt in 2025 when they got very caught, helping customers hack targets across #WhatsApp.
WhatsApp did the right thing & notified users.
https://blossom.primal.net/eac330ca904f2815e0a813106efe494fd28fd512728b6e561b3c92a4ea309393.png
Almost immediately after the WhatsApp notifications, we started learning about the targets.
They weren't the supposed serious criminals... They were Journalists... human rights defenders...groups working on sea rescues.. etc
In other words, a very NSO-like scandal.
https://blossom.primal.net/a530f88b24d07ffae346e2ed762a391f0e3908142a1aa2032a87bcfe0fb649b0.png
Ultimately Paragon & its Italian customer had a massive spyware scandal on their hands.
WhatsApp wasn't the only player tracking paragon & doing user notifications. Apple got in on the game.
Ultimately, we at the Citizen Lab had forensically analyzed cases from each notification round.
https://blossom.primal.net/312ea0ccc0a650ab5d77c84cd714687bb6e0f18f47159ae91562a2b7f98270ec.png
We testified to Italy's parliamentary intelligence oversight committee about our findings.
https://blossom.primal.net/e6cfcf41d686d7fd1c64f12caf1fc2e5e93b9912536fd63abb51259c4a6633b9.png
https://blossom.primal.net/79cb9ecdfe9c86ba9a4e051f93b8f74d9329f7b14a68e4b1ad7cf382c227d8e0.png
The conclusion? Deeply unsatisfactory.
Italy admitted hacking some targets, but denied hacking journalists.
Tons of loose ends with Paragon. And they haven't been honest about who used their tech to hack journalists in Europe.
BIG PICTURE:
After 14 years investigating countless spyware companies, I tell you with confidence:
Mercenary spyware is a power abuse machine incompatible with American constitutional rights and freedoms.
Our legal system isn't designed for it, oversight mechanisms are woefully inadequate to protect our rights...
Here's the thing. You probably know that mercenary spyware like #Pegasus gets sold to dictators.
Who, predictably, abuse it.
But We have a growing pile of cases where spyware is sold to democracies... and then gets abused.
HISTORY LESSONS
History shows: secret surveillance usually winds up abused.
The history of the US is littered with surveillance abuses.
Thing is, our phones offer an unprecedented window into our lives.
Making zero-click mercenary spyware an especially grave risk to all our freedoms.
If the government has wants access to your accounts for law enforcement...they have to prepare a judicially authorized request and send it to the company, which reviews it.
Mercenary spyware bypasses any external review.
And the whole industry behind it seeks maximum obscurity.
COUNTERINTELLIGENCE THREATS? YEAH THAT TOO
I'm concerned about the impact on our rights an dour privacy.
But there's something else that should worry everybody about the choice to work with the company: Paragon poses a potentially grave counterintelligence threat to the US. Let me explain.
When you use an integrated spyware package to conduct sensitive law enforcement / intelligence business, you have to place a lot of trust in them...
If the developers originate from a foreign intelligence service that aggressively collects against the US government, that should be a huge red flag.
America (or any country) should be maximally wary about using foreign-developed surveillance tech for the same reason that America shouldn't operate a Chinese-made stealth fighter.
So, have Paragon's spyware, people & ops been aggressively vetted for technical and human counterintelligence risks?
MERCENARY SPYWARE = FATE SHARING
Paragon's #Graphite mercenary spyware shares the same downsides as other products in their class:
❌They keep getting caught
We researchers aren't the only ones that have found techniques for tracking and identifying Paragon spyware... I'm sure hostile govs have too.
https://blossom.primal.net/0e709adfa8b5b3dd375c80180988f8e322c36d1803e4c25ec1bde250716c8302.png
❌Customers fate share.
Since all customers roll the same tech, when one gets caught it impacts & potentially exposes everyones' activities.
Now, that fate sharing will include US law enforcement activity.
WHAT CAN YOU DO?
What can you do? Take 5 minutes and call your member of Congress.
Ask them to request a briefing on Paragon.
They should ask whether the company was properly vetted & reviewed.
What is the oversight mechanism for this maximally invasive technology?
What are the guardrails? How would abuses be handled? Etc.
PERSONAL SECURITY?
Paragon & this category of spyware is fiendishly hard to track & defend against.
And on a personal level? Apple's Lockdown Mode & Android Advanced Protection both offer some serious security benefits but neither is a silver bullet..
Unfortunately, as of right now I am pretty confident that no publicly available / commercially developed third party tool can reliably detect Paragon spyware either in realtime. Or retrospectively.
Beware a false sense of security.
If you got this far & found this post useful, let me know! Drop a comment.
SELECTED READING LIST
Exclusive: ICE reactivated its $2 million contract with Israeli spyware firm Paragon, following its acquisition by U.S. capital
https://jackpoulson.substack.com/p/exclusive-ice-has-reactivated-its
Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations
https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/
Graphite Caught
First Forensic Confirmation of Paragon’s iOS Mercenary Spyware Finds Journalists Targeted
https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/

2025-08-22 02:16:34 UTC

- reply

Warning people on national TV that VPNs let them slip past age verification might be the slickest free advertising the VPN industry has ever received.

2025-08-21 14:41:38 UTC

"everybody who's out there thinking of using VPNs, let me just say to you directly, verifying your age keeps a child safe...So let's just not try and find a way around. Just prove your age."
- UK government.
https://blossom.primal.net/603be98e6ef0e56611d5583c63c9ec0b2461541b81785456cd0441048b2db5d3.mp4

2025-08-07 21:46:57 UTC

- reply

My prediction for the UK's Age Verification?
The failure to protect children will become obvious.
But the systems that force grownups to provide their IDs before sharing political views will persist.
Because too many bureaucrats and certain big corporations benefit.

2025-08-05 16:45:14 UTC

How are Daily Active User numbers looking on #Nostr these days?
#AskNostr

2025-08-02 21:45:52 UTC

It seems to me like a strong anti-AI view is becoming left / progressive coded.
I'd love to understand this better.
Anyone have thoughts?

2025-07-28 18:52:41 UTC

The EU's Digital Identity Wallet project has a lot of big icks.
Looking at the GitHub for the android Age Verification application feels like chewing rocks.
https://blossom.primal.net/bdf09dad278f101fecfe66177c4b38e8f209581fac0a3b1ab0d54ea9ed77f18f.png
Like the proprietary attestation baked into a must-use form of identification is absolutely the wrong path...
https://blossom.primal.net/e6f73e0cb71e378b675adddbd84df59beca65bc034c82b1388e15a4f7d7b3762.png
And while we're at it, recall the rule of thumb: Age Verification either by deliberate or convenient naïveté is almost always a surveillance trojan horse.
Source:
https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui

2025-06-20 13:40:33 UTC

🚨NEW REPORT from us: exposing a new social engineering/hacking tactic.
🇷🇺Russian state-backed hackers successfully compromised a prominent (& professionally paranoid) expert on Russian military operations.
Shocking, right? But the attack is solidly clever & worth understanding. I expect more like it.
https://blossom.primal.net/151037fad612bb0112412f07189b1ec3479e3ebd709221dd99af94e1b4123507.png
ATTACK FLOW
Keir Giles gets a message purporting to be from
U.S. State Dept asking for a consultation.
The attackers send the message from a gmail, but CC'd a bunch of email addresses state.gov email addresses. Including one from with same name as the purported sender.
https://blossom.primal.net/e9b747098271f185e66adda014e5d050f570a0120000d74724fd0f376eaa56ba.png
Strong credibility signal to have a bunch of gov ppl on the CC line right?
Well, what the attackers were counting on is that the State Dept mailserver just accepts all email addresses without emitting a bounce.
So they seem to have just created some fake State Dept staff names and addresses.
INTRODUCING THE DECEPTION
The attackers wait for the 2nd interaction to introduce the pivotal deception: getting him to 'connect to a secure platform.'
https://blossom.primal.net/da077358623aab8cc204741a4db027cf41d461254422fadec7872c2d0a94ed4f.png
In the next days they patiently walk him through what they want him to do, even sending a very official looking (but fake) State Dept. document.
https://blossom.primal.net/e4dcc76e9e00377d285dfd3392171aeb604f8be0dac94746db4e11459cee65b8.png
The attack works like this: the attackers try to deceive the target into creating and sharing an App-Specific Password (ASP) with them.
They do this by reframing ASPs as something that will let him access a secure resource (spoiler: not how this works)
REMINDER: WHAT IS AN ASP?
What's an ASP? Well, not every app that users want to use supports Multi-Factor Authentication.
Some older email clients for example don't. So providers like #Google let users create a special password just for those apps.
https://blossom.primal.net/ecc8d336f426eaa27ae4744e7f4cb4c2cac3edd0ec17d6da83bc77b4673aeac8.png
There were so many clever bits to this attack, it's easy to imagine a lot of people falling for it.
https://blossom.primal.net/8d0ed38e7478f802ad67adabc91a6e7f8d4e8453b1dd7c2328732864b5aa0815.png
Everything was clean. Doc looked real. The language was right. Email addresses at the State Dept. seemed to be CC'd.. I could go on.
They even had Keir enter "ms.state. gov" into the ASP name...
SLOW FOOD SOCIAL ENGINEERING
This attack was like slow food. 10 email exchanges over several weeks! Very much not your run-of-the-mill phishing.
It's like they know what we all expect from them...and then did the opposite.
Ultimately, he realized something was wrong and got in touch with us at #citizenlab ... but not before the attackers got access.
He's said that he expects some sort of 'leak' constructed out of a mixture of his real messages & carefully added falsehoods. I tend to agree, this is a pretty common tactic.
Here's what that looks like, btw, from a report we did back in 2017 where we compared what was released after a hack by Russian hackers vs the original:
https://blossom.primal.net/d78c6546306d909b92b1f2df20371c9eeff07b1bfe9081cff27cadf7dc14e1ab.png
Coda: Hilariously (to me at least) the attackers called the fake platform it *MS DoS*
https://blossom.primal.net/ccba459e840ce297664a2bda301d1438b3b8e51b585d169addcf8d21964c7fff.png
WHO DID IT?
Enter the Google Threat Intelligence Group w/analysis & attribution.
GTIG had been working on their own parallel investigation. Our friendly social engineers are: 🇷🇺 #UNC6293, a #Russian state-sponsored threat actor.
https://blossom.primal.net/515d82cd455084e58ae7dff4d35bd5d435912eb37851c400975a236e0ee498b0.png
Google adds bonus additional low confidence association to #APT29 (that would be Russia's #SVR).
Nice people.
TAKEAWAYS?
Takeaway: some gov-backed groups are feeling pressure & experimenting.
Moving from smash & grab phishing... to subtler, slower & perhaps less detectable.
Targeting App-Specific Passwords is novel.
But it's just part of a trend of state-backed attackers innovating & moving beyond simple phishing that targets credentials (maybe multi-factor codes) towards other mechanisms of account access.
https://blossom.primal.net/336640b188c251fa283158375999307dcca111d77eae861bd0a35f74543eed45.png
A lot of more sophisticated attackers are also spreading attacks across platforms.. for example starting the attack on Signal/Telegram, then later pivoting to email, etc. The folks at Volexity (above pic showing a similarly complex operation) have some good reporting on that (link below)
GET SAFER
Do you think you face increased risk because of who you are & what you do?
✅Use Google's free Advanced Protection Program.
Set it up now: https://landing.google.com/intl/en_in/advancedprotection/
https://blossom.primal.net/e5cf606d56a80fd5beff0b27169d03de332bb6653b95bcff6fe4335ec5630dac.png
✅Exercise extra skepticism when unsolicited interactions slide into suggesting you change account settings!
https://blossom.primal.net/56bd9a26f59aa26cfccb5d6aa4570a7b9cb0ad34b25f36fe692098baa3d80e19.png
✅Talk to your IT/ Security team about ASPs. Share the report, we've made some suggestions for them..
READ THE REPORTS
Ours at Citizen Lab: https://citizenlab.ca/2025/06/russian-government-linked-social-engineering-targets-app-specific-passwords/
Google's Post: https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia
Other citations:
Our Tainted Leaks report where we walk through how materials got manipulated & leaked after a Russian gov hack: https://citizenlab.ca/2017/05/tainted-leaks-disinformation-phish/
Volexity's recent report:
https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/

2025-06-16 19:21:36 UTC

New: WhatsApp announces that they are adding advertising.
Ugh.
https://blossom.primal.net/76573b7d579cdd2595cd6d8ea5c47da8fe7c3a4ddaca0c6547805ffe978251f3.png
As a researcher working on targeted / 0click attacks (including a few that have been done over WhatsApp..) it's hard to see how this works without opening up a fat new attack surface to be probed.
https://blossom.primal.net/433f053e064ffb25187f1fd2e61eba7f82ada119765f79f75a1dbbe438658da7.png
I'm also worried about the ways that these advertising signals get used for tracking people in new parts of their digital lives.
And it bugs me that it's going to be really hard if not impossible to use WhatsApp in a privacy-first way.
What are your thoughts?
Writeup: https://techcrunch.com/2025/06/16/whatsapp-is-adding-ads-to-the-status-screen/

2025-06-11 23:07:08 UTC

Pizza places near Pentagon showing a *lot* of activity.
That favorite conflict indicator coupled with sudden cascade reports of US embassy evacuations & non essential personnel voluntary departures + rhetorical change in statements about talks with Iran... it's enough to make a lot of people start speculating about threats of strikes into Iran.
Disclaimer: Me? I'm not even an armchair geopolitical expert. And I'm certainly not smart enough to know if this is just signaling, or whether something happens soon. Or a bit later.
https://blossom.primal.net/c9ad2618f2217a17dcddacc0c3341a61dbe2c9346c1231f3003e6864e7a34588.png https://blossom.primal.net/afc0fcaefd87949ca766578a96872e99d1cfd6df1a2b22ac637a7cb76fd6cd39.png

2025-06-10 13:29:30 UTC

Understanding grows when scientific knowledge is shared.
Yet in 2025 some journals still gatekeep important research.
Like this review of links between depression & inflammation.
$35 if you aren't at an institution with a subscription.
Imagine if a library that charged $35 to read a book?
https://blossom.primal.net/e464889c5b49019eace6432b760bd6f66a2edf31539826f1a8f765a133d8bfae.png
That's enough friction to keep the knowledge from most of the globe.
Every time I encounter knowledge gatekeeping in a health related journal I wince.
I wonder if the American Journal of Psychiatry has considered the costs to the field, and our global mental health, of staying closed?
https://blossom.primal.net/8a6d134cfeab32c6434b8dbc7982ccc20f4a06ba142b6183d5f792fe8b3f6b0f.png
The thing is, I can personally read these articles thanks to my institutional affiliation.
But the momentary friction as I cross through the paywall reminds me that most people can't.
The article: https://psychiatryonline.org/doi/10.1176/appi.ajp.20250289

2025-06-03 10:44:39 UTC

- reply

You might be right. And an even bigger argument for why it makes sense to pay attention to the network effects that can be harnessed, minus the VC vibes..

2025-06-03 10:10:13 UTC

VERY interesting research on how academic twitter migrated to #Bluesky.
Interesting topline takeaways for growing #nostr. No rocket science that's not been said before, but it's nice to have some data:
1- External shocks are key. Capitalize on them. >15% of transitions explained this way. Think geopolitical events, outages, Musk making a big disliked policy change etc.
https://blossom.primal.net/bf7b42d4e5dfb1bfd81d36cd7bb4aab961c2d4c7af41d0e9298f61af62af9da8.png
2- Audiences move from incumbent platforms following influential voices that they follow. Focus on onboarding these influential voices. This is more impactful than just trying to bring the whole audience first.
https://blossom.primal.net/50d77aaffce370c49f1cc853471560ce49c8e560cb5551bf79168704335ed781.png
This dynamic can build contagion. Find ways to more publicly highlight when influential accounts join.
And make it super easy for Nostr users to use clients to reconstruct followees & social graphs from incumbent platform. Trick will be to do this in a privacy respecting way.
(sidenote: that's way the follow packs were such a good idea. But we need much more of this)
(note: influential voices may experience a period of 'where's my audience?' So it's key to find ways to get the transitioning user from that to the reconstruction of their network. )
3- Multiple peers transitioning is key. Having local clusters develop is important (& probably helps with the dry period before an audience is rebuilt.)
Interesting nuance: transition rates to #bluesky were 25-30% in fields like arts/social sciences, but about half that in medical / physical sciences / engineering. Possible predictors include baseline political engagement & political values expressed.
https://blossom.primal.net/bf60153b7d7a9a282b632d2f120a9883391a7a902b577f12abdfec90d5c93942.png
This has an implication for Nostr: focus messaging on Nostr features that may align with people in incumbent platforms. There has to be desire.
Paper "Why Academics Are Leaving Twitter for Bluesky" https://arxiv.org/pdf/2505.24801

2025-05-01 12:32:17 UTC

- reply

Any time you see a name like 'Tools for Humanity' you should slow down and scrutinize.
Especially when paired with AI hype.
The level of documented exploitation around the WorldCoin project is wild.
Everything @nprofile…cms0 said x1000.
https://blossom.primal.net/1a809ee53b3740691e66ba6be67084648ff4a0ca232028d2a4ec4c8952b434e0.png
Now the company wants more data.
https://blossom.primal.net/133bc1022f0bc76a5544028188cdc1da99c3521d473623e529afa39e88a55c41.png
Exploitation was baked right in from the earliest days of this hype train. https://blossom.primal.net/ae2b4dd3b61c4d6ce1f160470569c1eae36eb2af1635bf048a9ac8df26f47d1a.png
Sources;
-https://www.dlnews.com/articles/people-culture/how-worldcoin-crypto-biz-in-berlin-exploded-in-fistfights/ -https://nation.africa/kenya/news/kenyans-scanning-their-eyeballs-worldcoin-cryptocurrency-tokens-4319600
-https://www.technologyreview.com/2022/04/06/1048981/worldcoin-cryptocurrency-biometrics-web3/
#nevent1q…8h7w

2025-05-01 11:49:15 UTC

Friends don't let friends get their eyeballs scanned to buy a coffee.
This portable dystopia machine is Tools for Humanity's latest effort to live up to their Orwellian name.
https://blossom.primal.net/7d3f813ec8e8f88e1a8a65895687a43d772b2d908e88b1e69c79e84b2110f578.png
Connoisseurs of the AI-will-end-humanity marketing hype train of a few years ago should find plenty to appreciate in an eyeball scanner framed as as a 'helpful' tool to distinguish between AI agents & humans.
Or is it for that? Or maybe point of sale? Or nebulous 'verification?'
The only clear thing? This device starts from a point of biometric #privacy invasion.
https://blossom.primal.net/f157bbd63933c1cbe87afc9af071afb975504950e1cf151d5e1688afcf47cd21.png
It sure looks to me like another effort by the company Sam Altman founded to make a global data-grab.
https://blossom.primal.net/8cf71cc4ea27e87adbbe93081213e0f6bae366791e92896eaacd60702371ee08.png
Just say no.
https://techcrunch.com/2025/04/30/sam-altmans-world-unveils-a-mobile-verification-device/

2025-04-29 19:52:34 UTC

- reply

Part of what makes Nostr so special.
No other community comes close to this much experimental *building*

2025-04-24 10:46:05 UTC

Government censorship has come to #Bluesky.
https://m.primal.net/QbYz.png
LATEST:
On demands from the Turkish government, Bluesky restricted access to 72 accounts per a report from a Turkish NGO.
https://m.primal.net/QbXO.png
DETAIL:
Accounts are restricted for users in Turkey.
Accounts aren't banned from Bluesky's AT Protocol relays etc, but access is moderated at the official client level through geography-specific labels.
https://m.primal.net/QbXg.png
WORKAROUNDS?
Realistically impacted accounts are no longer visible to the majority of Bluesky users (most aren't on 3rd party clients) in Turkey.
However, since 3rd party client apps for the AT Protocol aren't forced to use geography-specific labels, they an still be used to view the content.
In theory, official client + VPN would also result in seeing the accounts.
LOOKING AT SOME DATA:
Bluesky has been publishing transparency reporting about legal & government requests. The most recent report covers 2024 and shows a relatively modest number of takedown requests, but about 50% response by Bluesky.
https://m.primal.net/QbYR.png
Unfortunately, the company doesn't differentiate between legal demands in civil litigation and *government* demands. This makes it hard to get a clear picture.
https://m.primal.net/QbYr.png
I hope Bluesky segments out these very different kinds of pressure in 2025 reporting so we can get a better sense of what's happening.
BIG PICTURE:
Looking ahead, governments are probing for new ways to enforce content restrictions. These are early days for Bluesky and it is likely that a lot more requests like this will be inbound as users head there to try and avoid the well-greased censorship machinery on legacy platforms like X.
Recommended reading & Sources:
Super-helpful-to-me TechCrunch article: https://techcrunch.com/2025/04/23/government-censorship-comes-to-bluesky-but-not-its-third-party-apps-yet/
Mastodon post confirming blocking with testing : https://mastodon.online/@mastodonmigration/114348331162291326
Bluesky post with the notification email screenshot: https://bsky.app/profile/aliskorkut.com/post/3lmul5pt34c2b
Bluesky 2024 Moderation Report: https://bsky.social/about/blog/01-17-2025-moderation-2024
Bluesky post describing geography-specific labels as a content-removal technique: https://bsky.social/about/blog/09-18-2024-trust-safety-update

2025-04-23 16:17:39 UTC

They Criticized Musk on X. Then Their Reach Collapsed.
https://m.primal.net/Qagt.png
Graphs from this story are stark.
https://m.primal.net/QahA.png
Link: https://www.nytimes.com/interactive/2025/04/23/business/elon-musk-x-suppression-laura-loomer.html

2025-03-29 21:56:02 UTC

Most folks don't love security theater & everyone has had a bad time at a screening checkpoint.
So, let's think for a second about hypothetical private-#TSA companies.
I'd expect them to gravitate towards AI-assigned individual risk ratings to minimize the cost of hiring & training people to interact with travelers.
To create ratings, I'd expect them to demand & consolidate invasive pools of our biometrics, web browsing, commenting, purchasing, movements & private lives.
Just don't call it a "social credit score"
You can bet they'll pivot to trying to monetize their data.
2026: We're a terminal security company
2029: We're a person rating company
Would these ratings make their way into other parts of our lives & things we want to visit?
And who exactly would stand up for us when the ratings are wrong? Or our data is shipped to foreign buyers.
Who holds #PrivateTSA companies accountable? The US doesn't have strong #privacy protections...
I'm also not optimistic about private sector security companies' ability to stop breaches. History backs me up here.
But I do expect that private-TSA companies could use lobbying to limit oversight & accountability.
That's been the history of other privacy-invasive tech companies.
So, as an airline security privatization conversation kicks off, remember that it can't just be "current thing is bad" but needs to consider what kind of future we're inviting in. https://m.primal.net/Pxhw.png

2025-03-28 22:01:51 UTC

- reply

haven't listened. do you have a suggested track?

2025-01-26 18:33:25 UTC

- reply

I'm glad you found it interesting. Love the podcast.

2025-01-26 16:53:05 UTC

Hi everyone, I'm JSR.
Me & my colleagues chase government hacking & censorship of dissidents & activists.
Heard of Pegasus spyware? Then you know about our work.
I'm part of the Citizen Lab, a ferociously independent research group based at the University of Toronto.
We try to 🥊punch above our weight.
Your device has probably gotten security updates that flowed from our collaborative investigations.
Craziest story? When we punked a team of mercenary🕵️ spies sent to target our research. https://www.youtube.com/watch?v=Z8IrU_jvnFk
I'm so proud of my colleagues & talented collaborators in the fight to serve fat helpings of good trouble & accountability.
All the good research I've worked on has been a team production... But everything I say here, especially the typos & bad ideas are100% mine.

2025-01-25 19:00:07 UTC

The official instinct to solve all problems by application of surveillance dystopia is a feature, not a bug.
https://m.primal.net/Nzwy.png https://m.primal.net/NzxA.png

2025-01-23 16:28:06 UTC

Wait, people can support me in real value, not just magic internet points that are revokable without notice?
Zaps just blew my mind.

2025-01-05 03:17:08 UTC

Heard about a big breach over at Volkswagen?
https://m.primal.net/NScA.png
Here's whats going on. Every major car company collects your driving data. And everything I've learned about this subject makes me want to go into the dash and start pulling wires out.
100% of car companies collect unnecessary data
84% share/sell it
92% provide insufficient control over data.
(Data: Mozilla Foundation investigation)
https://m.primal.net/NSad.png
Most pour it into the shady data-broker ecosystem.
Where it goes to god-knows who. And represents a really exciting stream of surveillance data for governments and everybody else.
https://m.primal.net/NSam.png
Most also turn it over to governments.
And insurance companies.
https://m.primal.net/NSbI.png
We got here because, in search of new revenue streams, these car mfrs turned to mining owners for movement data.
Their disrespect for your #privacy is a through-line, and is reflected in just how sloppy they can be about protecting it.
https://m.primal.net/NSar.png
Unsecured AWS? Ugh. But this is just the tip of the iceberg.
This massive data exposure happens to be Volkswagen, but the story tracks for every major car company.
https://m.primal.net/NScW.png
When companies do offer some sort of opt-out... your car might break. Or so they warn you.
https://m.primal.net/NSbD.png
We are still in earliest days of people investigating and pointing this out, but things are bound to get worse with electronic vehicles.
Reading list:
Mozilla Foundation's key investigation: https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/
CSO Oline report on VW:
https://www.csoonline.com/article/3631055/volkswagen-massive-data-leak-caused-by-a-failure-to-secure-aws-credentials.html
Nissan breach report:
https://www.industryweek.com/technology-and-iiot/article/21258350/nissan-north-america-reports-consumer-data-breach