Think about it. It was released (read: forcibly shoved down our throats) by Google and came out of nowhere when there were zero problems with the decades old and extremely well researched incumbent image/video formats that the web was already using (i.e. jpg, png, gif, mp4, etc). Google has confirmed ties to the US three-letter agencies through PRISM, as well as AFAIK all but confirmed ties to the Israeli government. BlastPass was reportedly apart of Israel’s Pegasus hacking suite for years before the vulnerability went public, and was actively exploited by Israel to track down political dissidents. It’s also the worst type of vulnerability there is, a buffer overflow resulting in arbitrary code execution, meaning once you exploit it you can do literally anything to the target device, from an image format, the type of file most people would never suspect to be capable of doing that (and indeed most developers never suspected that either, considering how everyone from Mozilla to Apple seemingly just took Google source code and incorporated it into their own software, no questions asked).

Maybe I’m just overly cynical, but I’m having a really hard time believing that such a critical vulnerability in such a widespread code base would be accidental, especially in the age of automated testing, fuzzing, and when the industry generally has a very good understanding of how to prevent memory vulnerabilities. The vulnerability was there since they very beginning of the standard and we’re to believe one of the largest software companies simply failed to spot it for years? I don’t think Hanlon’s Razor should apply to companies like Google because they have a long and shameless pattern of malice and have long exhausted their benefit of the doubt.

I have a sneaking suspicion that WebP was planned as a Trojan horse from the start to backdoor as much software as possible, and Google sold the exploit to the US and Israel govts. Why else would Google so relentlessly push an image format of all things unless there was some covert benefit to themselves? (An image format that’s not even patented/licensed mind you so they’re definitely not making money that way.)

What do you think?

President Maduro of Venezuela denounces

WhatsApp as a spying system

Venezuelan President Nicolás Maduro has accused

WhatsApp of operating as a spying tool and urged citizens to switch to alternative messaging apps such as Telegram and WeChat.

Speaking at a meeting in Miraflores Presidential Palace in Caracas, the president asserted, "WhatsApp provided its list of Venezuelan users to Colombian drug traffickers, who then conducted months of espionage."

After almost 2 years, Privacy Guides has added a new Hardware Recommendations section to their website.

Thanks to Daniel Nathan Gray and others for implementing this new hardware guide

We're happy to announce that BusKill is presenting at DEF CON 32.

What: Open Hardware Design for BusKill Cord
When: 2024-08-10 12:00 - 13:45
Where: W303 – Third Floor – LVCC West Hall

BusKill is presenting at DEF CON 32

via @Goldfishlaser@lemmy.ml

What is BusKill?

BusKill is a laptop kill-cord. It's a USB cable with a magnetic breakaway that you attach to your body and connect to your computer.

Watch the BusKill Explainer Video for more info youtube.com/v/qPwyoD_cQR4

If the connection between you to your computer is severed, then your device will lock, shutdown, or shred its encryption keys -- thus keeping your encrypted data safe from thieves that steal your device.

What is DEF CON?

DEF CON is a yearly hacker conference in Las Vegas, USA.

Watch the DEF CON Documentary for more info youtube.com/watch?v=3ctQOmjQyYg

What is BusKill presenting at DEF CON?

I (goldfishlaser) will be presenting Open Hardware Design for BusKill Cord in a Demo Lab at DEF CON 32.

What: Open Hardware Design for BusKill Cord
When: Sat Aug 10 12PM – 1:45PM
Where: W303 – Third Floor – LVCC West Hall

Who: Melanie Allen (goldfishlaser) More info

Talk Description

BusKill is a Dead Man Switch triggered when a magnetic breakaway is tripped, severing a USB connection. I’ve written OpenSCAD code that creates a 3D printable file for plastic parts needed to create the magnetic breakaway. Should anyone need to adjust this design for variations of components, the code is parameterized allowing for easy customization. To assemble a BusKill Dead Man Switch cord you will need:

1. a usb-a extension cord,
2. a usb hard drive capable of being attached to a carabiner,
3. a carabiner,
4. the plastic pieces in this file,
5. a usb female port,
6. a usb male,
7. 4 magnets,
8. 4 pogo pins,
9. 4 pogo receptors,
10. wire,
11. 8 screws,
12. and BusKill software.

Golden DIY BusKill Print

Full BOM, glossary, and assembly instructions are included in the github repository. The room holds approx. 70 attendees seated. I’ll be delivering 3 x 30 min presentations – with some tailoring to what sort of audience I get each time.

Meet Me @ DEF CON

If you'd like to find me and chat, I'm also planning to attend:

• ATL Meetup (DCG Atlanta Friday: 16:00 – 19:00 | 236),
• Hacker Kareoke (Friday and Sat 20:00-21:00 | 222),
• Goth Night (Friday: 21:00 – 02:00 | 322-324),
• QueerCon Mixer (Saturday: 16:00-18:00 | Chillout 2),
• EFF Trivia (Saturday: 17:30-21:30 | 307-308), and
• Jack Rysider’s Masquerade (Saturday: 21:00 – 01:00 | 325-327)

I hope to print many fun trinkets for my new friends, including some BusKill keychains.

Come to my presentation @ DEF CON for some free BusKill swag

By attending DEF CON, I hope to make connections and find collaborators. I hope during the demo labs to find people who will bring fresh ideas to the project to make it more effective.

Dear comrades,

Recently I got more into online privacy – due to my direct and indirect environment –, this is also why I created a new account that is harder to be traced back to me.

I was wondering I you have any advise of a two-factor authenticator that I could use that is safe and Linux friendly – especially on Tails –. I already tried looking for one online, like in the surveillance self-defense guide, but couldn’t find one in which I’m 100% confident. It would also be nice if this program/the key is able to be backed-up to my other tails usb-sticks with the persistent back-up feature.

Of course I already have one on my phone but don’t want to use this one because it would be easier to trace this account back to me.

Hope you guys have some good alternatives.

Edit: grammar

This article will describe how lemmy instance admins can purge images from pict-rs.

Nightmare on Lemmy Street (A Fediverse GDPR Horror Story)

This is (also) a horror story about accidentally uploading very sensitive data to Lemmy, and the (surprisingly) difficult task of deleting it.

What countries do you think would be less likely to disclose your private data? I was thinking of either Switzerland or Belarus. But here's some things to consider:

• Don't assume that just because countries have bad relations that they won't share private information with each other. For example, in 2021 the Mayor of Lisbon disclosed personal information of Russian immigrants in Portugal with the Russian government. This was an act of incompetence which resulted in a 1.2M€ fine. But the damage was done.
• Even if there are laws in place, the hosting company might have sloppy procedures in place and disclose your private information.
• The country should also not be the target of heavy sanctions because you might get in trouble for trying to do business with them.

So which countries do you recommend?