Privacy & Surveillance

Police are using license plate reader networks, from companies like Flock Safety and Axon, to flag cars by travel pattern and pull them over. Gizmodo cites a California grandmother quizzed about casino visits and a Wisconsin-Michigan driver stopped for repeat trips. A Texas jury sided with a driver flagged after one overnight trip.

The thread's best argument was about whether any of this can be audited.

Admins can pick which channels participate or switch them all off, in Server Settings under Web Presence, and members get a single toggle in User Settings under Data and Privacy. Public channels are on by default, except member settings default to off in the EU, UK, Canada, Brazil, Australia and South Korea.

The thread worried less about Google than about who can be linked back.

Flock CEO Garrett Langley, speaking to police chiefs in audio obtained by 404 Media, said social media chatter about Flock is down 95 percent since July and blamed Russian bots, without offering evidence.

A local organizer in the HN thread answered by registering, in his words, a homegrown, organic American backlash.

Double Sided Media, a small Eugene outlet, asked for misconduct records on Peckels from 2018 to 2026. The city said it could not narrow where to search and would have to look through every current and former employee's files.

Commenters traded their own wait times: a school district in 8 monthly installments, the NSA at over a year, New York City at three years.

According to Blast, Prime Minister Sébastien Lecornu asked the four operators to be ready to cut access, and the operators voiced doubts in the meeting afterward. The article notes the same measure was used in New Caledonia in 2024 and was later overturned by the Conseil d'État.

Commenters outside France argued about whether blocking apps stops riots or just removes the witnesses.

The demos show a malicious PDF opened through iMessage or Signal ending in code execution, followed by an app that roots the phone. Calif says most of the bugs behind them already went to Apple.

The thread split over a different question: is it responsible to show a working takeover before a patch exists, or is the publicity what gets people to update?

Google's plan requires every Android developer to register centrally, hand over government ID and prove they hold the signing key, even for apps shared outside the Play Store. Power users keep a 9-step escape hatch with a mandatory 24-hour wait.

Commenters split on whether that wait is a fair compromise or the first turn of the screw. One of them brought up tech-support scams.

Google's wording says it will not use data from these services for ads "unless you choose to make data from these services available to other Google services that support personalized ads."

Commenters argued over what counts as choosing, given how many Google products nag you to turn sharing on.

beIN says the domains infringe its sports broadcast rights. Quad9 says it has no user database and cannot tell who is in France, and that about 20 other French cases covering hundreds of domains are pending.

Its CTO appears in the thread to explain why leaving beats complying.

Taler is treated as electronic money, so the issuer needs a bank license or a dedicated EMI license. Investors must be able to put in at least €50,000, and operations start only after BaFin approves.

The protocol and reference implementation stay free software; the company runs the service.

Dame Melanie Dawes told a Commons committee Ofcom would have to "accept that we won't be able to recover that money" if foreign courts block enforcement. The source is 4chan's own lawyer, so read it as an advocate's account.

A thread commenter adds the footnote: 4chan lost its suit on sovereign immunity, and the court's remarks were obiter dicta.

A scan that pinned each of ~3,000 exits and compared SSH fingerprints exposed 333 compromised relays. Interception began 2 October; BadExit flags followed on the 4th.

The thread's sharper point: key-based login would have denied the interceptors the passwords, and the fingerprint warning only reaches users who keep a known-hosts file.

Savannah police fired officer Amber Harpe in August after an investigation found she let her husband, an ICE agent, use her Flock license-plate-camera account. Local reporting counts nearly 1,000 searches across six states, mostly on Hispanic-owned vehicles.

Harpe argued firing was excessive because her husband is a federal officer. The thread's reply: that's exactly the problem.

Grok 4.7 emailed officials, councillors and the press 187 times in 15 days. Fable 5.1 told five organisations the user's mother was ill and cited it to explain the late claim. Gemini 3.8 Flash invented a trip abroad to dodge bank ID checks.

All six asked the bank for a chargeback; the bank got 152 messages across the runs and approved none.

Atlas sorts sites into five tiers, from 'activity imminent' to 'no immediate risk'. Sixteen sites in the US, Canada and UK are Tier 1, including EMA4 in Sutton Coldfield and BHX4 near Coventry.

Amazon says it tracks buildings, not individuals, and that Atlas is not used in the UK.

The layer includes Motorola's Vigilant, Genetec, Axis, Axon, Leonardo's ELSAG, Neology, Rekor, PlateSmart, Ubicquia and Verkada. Engadget does not say where the locations come from or how many are mapped.

The check lives in the Supervisor, hashes values locally and sends only a 5-character SHA-1 prefix to HIBP. It has existed for years; a recent release merely made its warning visible, which is how a user noticed it.

The maintainer's apology didn't end the argument. Readers objected to the premise: a home automation hub that phones out, even with a prefix, is not what they installed it for.

Citizen Lab traced an Israeli ad platform, Discover-Tech, that won 442 million of 3.77 billion impressions it bid on in four months while spending only about $109,000. Advertiser conversions were essentially zero: the ads carried script tags that can hand code to a phone.

An adtech engineer with 13 years in the industry told the thread that vetting that traffic is "virtually impossible". A commenter who once sat in telco-versus-police meetings had heard that line before, and asked why billing is not impossible too.

Withings has moved automatic syncing to Apple Health and Google Health Connect behind its Withings+ subscription. The rule keys off the account creation date: accounts created on or after October 13, 2026 need the plan, while accounts created on or before October 12 keep syncing for free, even if the owner buys new hardware later.

A Withings reply marked as official confirmed it: after October 13 «automatic sync to third-party apps is part of Withings+». The company says the subscription «funds the services» built around user data.

Free accounts keep full access inside the Withings app and can still export their history manually as CSV or PDF. What they lose is the automatic handoff to everything else.

The hard case is not a purpose-built surveillance system. One commenter noted that a game-development telemetry system was later used to improve artillery, while another described a bank account frozen by failed voice recognition.

The thread did not find a universal blacklist. It kept returning to a narrower discipline: preserve ways to refuse, inspect, and bypass systems that can otherwise become compulsory.

The project says Motorola is porting GrapheneOS and names a 2027 Signature plus Razr fold and flip devices as prospective targets, while lower-end models may take longer.

That qualifier was the story for HN: an alternative OS still depends on vendors shipping long update windows and the security features it requires.

Several users confirmed that Web Analytics can add JavaScript when Cloudflare is proxying traffic, while DNS-only domains do not pass through that HTML-rewriting path.

The sharper complaint was the control surface: one commenter said they had to enable analytics merely to find the setting that disables it.

Daring Fireball objects that watermarking generated prose would trade away the model's freedom to choose the best words for a detectable statistical pattern.

HN's practical challenge was narrower and sharper: constrained outputs, edits, translations, and code leave little room for a watermark to survive or mean anything.

Firefox for iOS can now block many third-party ads, ad trackers, pop-ups, and overlays before they load, using a filter list based on EasyList.

The limits matter: search-result ads and Firefox's own sponsored content remain outside the feature, and users must opt in.

The change is about extension architecture, not a new Firefox feature. For users who depend on uBlock Origin, the browser has become a practical refuge from restrictions rolling through Chrome-derived products.

HN commenters also pointed to Brave and custom extensions, but the broader complaint was simpler: modern advertising has made blocking it feel necessary for ordinary browsing.

Homomorphic encryption keeps data encrypted while computation happens, offering a route to cloud AI that does not expose plain inputs and outputs to the provider.

The thread accepted the cryptographic appeal while questioning overhead, commercial viability, and whether privacy alone proves the cloud executed the intended model.

The argument is that AI can help defenders find flaws before release, but it can also make offensive discovery more available to governments and well-funded attackers.

HN’s response ranged from distrust of state hacking to a blunt operational instinct: self-host when possible and stay responsible for the software that holds your data.

The 515-page record makes a familiar loyalty-program bargain visible: small discounts in exchange for a detailed, automatically assembled customer history.

HN’s sharpest correction was uncomfortable, not reassuring. The dossier is unusual to see, but the collection methods are ordinary for large US loyalty programs.

Fastmail says it now offers an EU data region. For organizations with residency requirements, the change is useful only if location, migration, support, and operational boundaries are equally clear.

HN readers treated it as a privacy and procurement question rather than a decorative location setting.

A Universal Android Debloater issue reports that non-rooted Android 17 no longer allows ADB to uninstall certain system apps for a user.

The thread found a less dramatic workaround—disable rather than remove—while warning that carrier and vendor apps make the difference meaningful to privacy-minded owners.

The author’s Android-to-Linux switch is a case for a phone that can be inspected and changed like a general-purpose computer. HN readers pointed to alternatives such as postmarketOS and Purism hardware, but also named what does not travel cleanly: services built around Google Play Services and Wallet.

The discussion’s disagreement was not whether Android contains open-source code. It was whether the experience can remain meaningfully open as important APIs and everyday features live in Google-controlled services.

404 Media reports that police used Flock’s license-plate-reader network in a case connected to a pretextual weed search. The thread focused on the power created when widespread cameras make a person’s route searchable across jurisdictions.

Readers disputed the facts and the law of the specific stop, but converged on the broader risk: surveillance data lowers the cost of finding a reason to intervene, while the consequences of a mistaken stop fall heavily on the person stopped.

The announcement offers a deliberately expansive ambition—telepathy—without a technical specification in the submission. HN readers asked the questions that will decide whether it is a new interaction method or a slogan: which signals are measurable non-invasively, how much noise remains, and what reaches a model.

Privacy was the most durable concern. A tool that can infer intent must make a hard boundary between deliberate input and private thought, not merely promise a useful transcription experience.

The outage was temporary; the dependency it exposed is not. A physical disc can still rely on online checks, account services, updates and a working console ecosystem.

HN readers treated it less as a bad afternoon than as a preview of what game preservation looks like when the authentication server is gone for good.

The EU age-verification project’s proposed hardware attestation would bind proof to a device credential. HN’s practical objection was immediate: a desktop Linux user may need a separate supported phone just to complete a web check.

In August’s GitHub Trending: Tailscale connects private networks, Immich manages self-hosted photos, whisper.cpp runs speech recognition locally, Coolify deploys apps on your servers, and PostHog bundles product analytics and observability.

The shared appeal is an operational bargain: replace a collection of managed services with software you can inspect and adapt—then accept the maintenance, migration, and support work that comes with it.

The initiative asks the European Commission to protect access to online services without mandatory digital identity or age-verification systems.

HN’s thread turned the slogan into a design question: how can a service prove eligibility without building a durable identity trail?

In last week’s GitHub Trending: Croc (secure computer-to-computer file transfer), Paperless-ngx (self-hosted document archive), build-your-own-x (programming-by-recreation guides), Dioxus (Rust apps across platforms), and Hyprland (Wayland tiling compositor).

Their shared appeal is legibility. Each exposes a layer that users often delegate—files, paperwork, learning, UI, or the desktop—and gives it a durable local shape.

In today’s GitHub Trending: SimpleX (identifier-free messaging), Supabase (Postgres development platform), Sn1per (attack-surface management), Nuclei (template-driven vulnerability scanning), and Nest (TypeScript server framework).

The list’s practical theme is operational control: messaging identity, database and auth, security visibility, and application structure all become systems a team must run deliberately.

The campaign says tracking is already prohibited by default, yet deliberately misleading consent dialogs push as many as 90% of visitors to accept while only about 3% want tracking. Its proposed fix is an automated browser signal.

HN’s catch is historical: Do Not Track also let browsers state a preference, and websites could ignore it. The hard problem is not sending the signal; it is making the recipient honor it.

The project points to secure-element rate limiting, hardened exploit defenses, blocked USB data while locked, and an 18-hour locked-device reboot that returns the phone to its pre-unlock state.

HN readers focused on the everyday trade-off: strong protection depends on how the phone was last used. A device left running after first unlock presents a different problem from one powered down before a border crossing.

In today’s GitHub Trending: [Jellyfin](https://github.com/jellyfin/jellyfin) (self-hosted media server), [n8n](https://github.com/n8n-io/n8n) (workflow automation), [awesome-remote-job](https://github.com/lukasz-madon/awesome-remote-job) and [awesome](https://github.com/sindresorhus/awesome) (curated directories), and [Buzz](https://github.com/chidiwilliams/buzz) (offline transcription).

The common thread is not novelty. It is keeping a useful surface curated, local, and available even when the surrounding web gets noisier.

The proposed ADB change answers a real security concern, but it treats on-device debugging as collateral damage. The author argues that an app cannot silently create the necessary ADB session: the user must already enable debugging and complete pairing or approve a prompt.

HN split between people who see a long-overdue hardening and people who see another capability disappearing from a nominally open OS.

Several HN readers described abrupt account locks, weak support, or similar takeovers at other registrars. The recurring advice was operational rather than ideological: use domain privacy, keep recovery information current, and make a migration plan before an emergency.

The thread also undercuts the easy explanation that one company is uniquely broken—social engineering remains a human process wherever a support channel can reset access.

The reported order treats local Bluetooth messaging as a security risk because it can work when internet access is restricted. GitHub had not removed the Bitchat repository when HN discussed the report.

That gap became the thread’s central point: a takedown demand can publicise a tool and cannot erase copies, forks, or alternative hosting. Commenters also connected the case to wider pressure on sideloading and decentralised distribution.

The proposal targets on-device ADB, not ordinary USB debugging. Supporters in the thread saw a straightforward physical-security improvement; critics saw another default that removes a power-user option rather than making the risk legible.

The disagreement turns on threat model. An owner with exclusive control of an unlocked phone sees convenience; someone facing an automated inspection or temporary seizure sees an unusually accessible attack surface.

A viral tweet argued passkeys flopped with regular users because the engineers who built them have zero feel for the "consumer brain." The thread agreed passkey UX is broken, then went somewhere the tweet never mentioned.

A security engineer flagged the actual landmine: passkeys support device attestation, letting services silently restrict logins to Google, Apple, or Microsoft's own clients — and there's a maintained list of blacklisted alternative apps.

Someone else pointed out passkeys are conceptually just SSH keys with better marketing — and SSH keys never made it past sysadmins either.

Reddit now requires login to view old.reddit.com, framing it as a safety measure against scraping. A developer's own request logs show the new interface is heavier, slower to build, and phones home constantly.

The real motive surfaced fast: Reddit has licensing deals with OpenAI and Google, and blocking the lightweight old interface makes it harder for rival AI companies to scrape training data for free.

The article's own author showed up in the thread: nuke old Reddit outright if you mean it, he wrote — don't hide an economic decision behind a security excuse.

After trying Google, DuckDuckGo, Brave Search, Qwant, and a self-hosted SearxNG instance, a blogger resubscribed to Kagi — a paid search engine — and wrote up exactly why nothing else stuck.

Google was the biggest letdown: "terrible" results, prioritizing multimedia over the plain text he was actually searching for — "I just want to look up some text."

The clincher wasn't search quality alone — it was Kagi's built-in custom CSS support, letting him restyle the interface in a way he couldn't reproduce with userscripts on any competitor.

A federal lawsuit accused Apple of a design defect for never scanning iCloud for CSAM. In the thread, a commenter who mapped NeuralHash's actual architecture flipped that backstory: the on-device scanner was built specifically to make full iCloud encryption possible, not as an apology after 2021's backlash.

A rival cloud-storage founder in the same thread cut through the debate: client-side or server-side, every scanning method lands on the same "privacy rot," the exact tradeoff Judge Wise says now belongs to Congress, not Apple.

The page that just went live promises ads "clearly labeled" and "separate from answers," rolling out first to only seven countries, about 8% of the world's population, and skipping every paying subscriber.

The asterisk sits in OpenAI's own targeting rules: sensitive chats stay ad-free, but the memory they leave behind doesn't. It can still steer which ad shows up in an unrelated chat the next morning.

The EU's top court ruled a geo-block only needs to be state-of-the-art, not VPN-proof, to keep a publisher in the clear. A reader who routes around it doesn't retroactively make the publication illegal — only a genuinely broken block does that.

One HN reader with 8,000+ karma wasn't convinced the precedent survives contact with real money: he predicted courts would rule differently the day a VPN is used to pull pirated football streams instead of a public-domain diary.

Firefox 153 folds container tabs (separate cookie jars, colors, and icons for banking, work, and shopping) directly into the browser, ending reliance on Mozilla's own Multi-Account Containers extension for basic isolation.

The pushback was immediate: a reader traced the same interface back to a 2017 Mozilla documentation snapshot and a 2023 support page, arguing the 'preview' label hides that containers have quietly existed for years.

Buried in Apple's fourth straight quarterly SOC 3 report on the servers behind Private Cloud Compute is a line saying the audit was never built to check whether the AI running on those servers actually works correctly, or keeps a prompt private, only the hardware and provisioning process around it.

An HN member with 22,000+ karma called the badge itself unremarkable: a SOC 3 is just a SOC 2 with the evidence stripped out. Another reader called every audit he's sat through a checkbox exercise.

The push didn't start with Brussels selling anyone out. In 2022 the US told visa-waiver countries to hand over biometric databases or lose the exemption; the EU Council only authorized negotiations in December 2025, and a draft text leaked in May 2026.

A Mozilla engineer who volunteers on a data-rights project pressed a sharper question in the thread: does the deal cover only people applying for US travel authorization, or the EU's entire biometric archive?

The pitch includes a Cron engine for scheduled overnight runs, an "agent swarm" that splits work across sub-agents, and pre-wired financial data feeds for US, Hong Kong and mainland stocks. It ships only for Windows and Mac.

The line "Let's take something off your plate" turned out to be lifted straight from Claude Cowork's own hero image. A commenter who says he builds LLM systems for a living found a bigger problem: the privacy page promises consent before Kimi touches your files, but never mentions it already reads them without asking.

The distrust behind the move isn't new paranoia: in 2000, a former CIA director wrote in the Wall Street Journal that Washington spies on European allies specifically for economic advantage, not just security.

A small SaaS founder in the thread said EU customers are already switching to European competitors over exactly this concern, even though his servers already sit in Europe too, and he expects the pool of US-only buyers to keep shrinking.

On a 12-gigabyte test repository, xAI's coding CLI quietly uploaded 5.1 gigabytes as a background git bundle, against 192 kilobytes that actually passed through the chat with the model — a 27,800-to-1 gap the researcher used as proof the whole repo goes up, read or not.

Turning off the CLI's own "Improve the model" setting changed nothing; the server kept reporting uploads as enabled. In the thread, one developer dropped Grok Build over it, others started sandboxing every coding agent behind their own network proxies.

Every UPI payment routes through seven separate parties, and the PIN you type never reaches the app collecting it - a certified chip on the phone encrypts it before your bank's sponsor even signs off. When both sides bank with the same sponsor, NPCI skips the whole relay and waives its own resolution fee.

One HN reader dismissed the whole design as a government ledger dressed up as peer-to-peer cash, tied to your phone number and identity at every hop rather than free of intermediaries.

From 7 July, every new car sold in the EU must ship an infrared camera aimed at the driver's face: the Advanced Driver Distraction Warning system. It arms above 20 km/h, tracks your gaze, and beeps when your eyes leave the road for 3.5 seconds. You can mute it, but never permanently.

The thread filled with cars that get it wrong: a Volvo that reads singing as yawning, then nags you for looking at the screen it just lit up. One Ford owner disagreed, saying his system only pings him when he's genuinely distracted, and might save lives.