Onno (VK6FLAB)

Anything and everything Amateur Radio and beyond. Heavily into Open Source and SDR, working on a multi band monitor and transmitter.

#geek #nerd #hamradio VK6FLAB #podcaster #australia #ITProfessional #voiceover #opentowork

  • 12 Posts
  • 76 Comments
Joined 2Y ago
cake
Cake day: Mar 04, 2024

help-circle
rss

They’ll use machine learning to determine based on your behaviour if you’re under 16, then they’ll ask for proof of age.

Thank you for making my point.



We know very little beyond:

  1. It will go live on 10 December 2025
  2. There will be heavy fines.
  3. Government ID is not allowed to be the only method.
  4. A self declaration (tick box) is insufficient as a check.

There are to my knowledge no third party providers approved for this legislation. The process to assess actual implementation details started in July 2025, and the results thus far are underwhelming to put it mildly, you might call it a shitshow.

Below is the official sum total of what we know, most of it motherhood statements and “coming soon”.

https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions

Media commentary wants to “protect the children”, but have no idea how you might do so, let alone consider the implications or implementation details.

Source: I’m an ICT professional with 40+ years experience.


Australian Under 16 media ban is censorship by stealth and data harvesting by law
The comments around the under 16 media ban seem to be missing a salient point. In order to determine if a user is under 16, you need to determine that for every single user .. including you! This means that your personal data will be harvested in order to determine if you are over 16 or not.
fedilink

What are you attempting to achieve by opening this list of urls?

What is the difference between running this script and setting this list as either a bookmark, or the homepage in your browser?

What does your network have to do with the reachability of these sites?

If you’re managing the privacy of your own network, why are you not monitoring those services?


I used to have a pihole running on my network, but now I just use the dns.adguard-dns.com on my network and phone.


OP was talking about Lineage, not Graphene.

If an app doesn’t have data it cannot share it.

If you don’t install the app, it cannot breach your privacy.

You don’t need direct internet access to leak information, for example, an app with access to your calendar has indirect internet access.


Keep your existing phone and OS.

Use it differently. Decide what information you store on it, which applications you install or disable, what permissions you grant and what services you use.

Just installing an OS to “debloat and degoogle” is not ever going to change anything unless you change your habits and you don’t need to change OS to do that.




The Hollywood hacking depictions are equivalent to seeing syringes being used on film. To the uninitiated it looks “real”, the reality is somewhat different.

Source: I’ve been an ICT professional for 40+ years and have had hundreds of (medical) needles poked in me over much of my life.



Privacy breaches come in many guises … this is one of them.


Yeah … that thought occurred to me as well.

I wonder if there’s a way that you can legally monetize the process, so the organisation who left a gaping hole … or several bazillion in this case … gets an education in corporate security and the researcher gets paid for their efforts. A corporate symbiosis if you like.

If course the non legal way is extortion … but that tends to go towards warfare and mutually assured destruction, rather than collaboration.

Perhaps this opens the door to a white hat penetration testing department at the corporate regulator who issues fines (which pay for the work) … but I’m not seeing any evidence of an appetite for anything even remotely resembling such a set-up anywhere on Earth.

Espionage on the other hand …




Seems like prima facie evidence evidence to me that Intel is about to go bankrupt. It reminds me of the “Intel Inside” warning labels of the 1990’s … seems like a good idea, until you realise that it’s sinister and counterproductive.



> Instagram’s new location-sharing update is raising privacy concerns, with users reporting their whereabouts were shared without their knowledge despite Meta saying the update is opt-in. > Experts warn that location-sharing features are linked to a higher risk of tech-based coercive control. > The controversy follows other recent privacy issues for Meta, including a lawsuit over the misuse of sensitive health data from a women’s health tracking app.
fedilink


In my experience, Sarcasm and Satire appear to have cultural hooks that prevent them from translating well online.




Not just the EU, the rest of the world. The whole point of OSS was to distribute knowledge across all of humanity, not just be used as a way to make trillions of dollars in profits by a few billionaires working off the backs of OSS developers.


cross-posted from: https://infosec.pub/post/25342439
fedilink


Undocumented “backdoor” found in Bluetooth chip used by a billion devices
Update: https://darkmentor.com/blog/esp32_non-backdoor/
fedilink

I only noticed the € vs $ because I was searching for the case, so all good.

It’s telling that they continue to attract fines. I saw the ones you mentioned also but didn’t have the energy to start digging.

Despite assertions made to the contrary in this thread, I’m not at all convinced that they’re doing anything other than maximising shareholder value to the exclusion of all other considerations, including making a risk assessment in relation to paying fines versus compliance with the law.


Interesting, when you read that article, it says that Meta will appeal, searching for the GDPR fine and the appeal, all I found was more fines, but no records of the results of any appeals.

Also, it was €1.2 Billion, not $1.2 Billion.


Again, you vastly underestimate the size of Meta.

In the last quarter of 2024 it shows a net income of $20,838 million. A $20 million fine would change that 3 into a 1 and again, that’s net income for just for three months.

Source: https://investor.atmeta.com/investor-news/press-release-details/2025/Meta-Reports-Fourth-Quarter-and-Full-Year-2024-Results/default.aspx


What are the legal implications of hosting this information in a different jurisdiction and are there places where this data would be legally protected?


Think about it in terms of risk / reward or if you like, shareholder value.

If the value of the data exceeds the fine combined with the risk of it being discovered, the data will continue to exist.

Factor in the cost of actually guaranteeing that deleting something across all online, nearline, offline and archived data stores and the chances of anything being purposely deleted are not high.

Accidental data loss, sure, purposeful data loss, I can’t see it happening.




Perhaps you should ask the moderator of the community from where that post was removed.


I’ve been using Adguard public DNS for over a year across my LAN and it works great, with much less hassle than a pihole, which I previously used for years.

I miss the ability to add random hosts to either black or white lists, but in reality only used it sporadically.


All google advertising does that. It’s blocked in my network too.


There is no mention of e-ink, OP has an Android device, I have an Android device, I read eBooks on it daily, I use FBReader. I’m not sure what all the kerfuffle is about.




And now you know why we’ve been telling you not to use Telegram.


You don’t need to.

By using metrics like IP address , age, gender, race, religion, city, workplace, application, website, favourite song, colour and flavour, throw in a few more questions and you can lucratively target specific groups of people.

By COMBINING those metrics you can target extremely small groups of people, groups with precisely ONE member.

No need for a unique GUID at all.


Effective for whom?

The users who’s data was disclosed, or the company that made the disclosure?


I discovered that I watch enough YouTube to warrant paying for a premium subscription. I’ve turned off viewing history (after one video, so the homepage renders).

This isn’t a solution for everyone, but it works for me.


I hear you, but in the last year I’ve begun wondering if full public disclosure isn’t a better way to go these days.

The sheer volume of breaches is overwhelming and in my experience (of over 40 years as an ICT professional) many companies sweep their failures under the carpet, hide behind crisis management teams and marketing speak, and ridicule those bringing issues to their attention.

Their disclosure is abysmal if it’s made at all and there are precious few who reveal precisely what data was exfiltrated or how the issue was remediated.

This way anyone can verify the issue and companies cannot hide, everyone sees precisely what’s leaked and can act accordingly.

If you know of a more effective way, I’d love to hear it.


So far the Wayland implementation requires embedded X11 which puts everything in the same environment again.

I’ve not yet discovered how to run separate Wayland screens across the network from a Docker container and I’m also not sure if either Chrome or Firefox actually support native Wayland, from memory they didn’t last time I checked.


I don’t know. When I built this, several years ago, none of that existed.


This is true.

However, I’m running trusted software, not the backyard efforts of someone randomly selected off the internet.

Additionally, the Docker container is running on a dedicated Debian virtual machine with only Docker installed.

What’s of deeper concern is that all instances are running on X11 which means that they all share information via the clipboard for example.


So, this cookie alert on theverge.com is both refreshingly honest and depressingly disturbing
A cookie notice that seeks permission to share your details with "848 of our partners" and "actively scan device details for identification".
fedilink
672
So, this cookie alert on theverge.com is both refreshingly honest and depressingly disturbing

RFC: Cross Platform Password Manager
How are you storing passwords and 2FA keys that proliferate across every conceivable online service these days? What made you choose that solution and have you considered what would happen in life altering situations like, hardware failure, theft, fire, divorce, death? If you're using an online solution, has it been hacked and how did that impact you?
fedilink

How much should an organisation reveal about a data breach?
There is a growing trend where organisations are strictly limiting the amount of information that they disclose in relation to a data breach. Linked is an ongoing example of such a drip feed of PR friendly motherhood statements. As an ICT professional with 40 years experience, I'm aware that there's a massive gap between disclosing how something was compromised, versus what data was exfiltrated. For example, the fact that the linked organisation disclosed that their VoIP phone system was affected points to a significant breach, but there is no disclosure in relation to what personal information was affected. For example, that particular organisation also has the global headquarters of a different organisation in their building, and has, at least in the past, had common office bearers. Was any data in that organisation affected? My question is this: # What should be disclosed and what might come as a post mortem after systems have been secured restored?
fedilink

How do you trust a U2F key?
U2F keys can be purchased online for the price of a cup of coffee. They're being touted as the next best thing in online security authentication. How do you know that the key that arrives at your doorstep is unique and doesn't produce predictable or known output? There's plenty of opportunities for this to occur with online repositories with source code and build instructions. Price of manufacturing is so low that anyone can make a key for a couple of dollars. Sending out the same key to everyone seems like a viable attack vector for anyone who wants to spend some effort into getting access to places protected by a U2F key. Why, or how, do you trust such a key? The recent XZ experience shows us that the long game is clearly not an issue for some of this activity.
fedilink