Notices by Frederic Jacobs (fj@mastodon.social)

🚩Red flags in supply chain security

- "There is a significant amount of unaccounted for mass”
- Hezbollah noticed the battery was draining faster than
expected
- Salesperson who conveyed the offer made a very inexpensive proposition for the pagers, and kept bringing the price down until he was pulled in

https://www.reuters.com/graphics/ISRAEL-PALESTINIANS/HEZBOLLAH-PAGERS/mopawkkwjpa/

China targeted and might have held for months access to the infrastructure used to do wiretaps on the AT&T and Verizon networks.

This is a huge "told you so" moment for the cryptographic community that has been saying that such infrastructure does present a huge risk to national security. China reportedly used this capability for intelligence collection, obviously without a warrant ...

https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b?st=C5ywbp&reflink=desktopwebshare_permalink

US intelligence discovered earlier this year that the Russian government planned to assassinate Armin Papperger, the CEO of Rheinmetall.
https://edition.cnn.com/2024/07/11/politics/us-germany-foiled-russian-assassination-plot/index.html

@nixCraft I wish there was the possibility to specify the usage of the scraping rather than the agent.

https://mastodon.social/@fj/112280775190792281

“Last year, CO2 increased by 3.36 parts-per-million. That’s a 10% greater jump than the previous record, which was set just a few years ago.

In sheer weight, last year’s surge added a record 26 billion tonnes of CO2 to the atmosphere — more than three tonnes per human.”
https://www.nationalobserver.com/2024/03/27/analysis/co2-jumped-record-amount-last-year

#ClimateChange

Thank you @arcanicanis for making us users on here safer and reporting this critical Mastodon vulnerability.

And @Gargron and team for the prompt fix and patching of mastodon.social.

If your instance isn't patched, you should probably ping your admin.

"Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account.”

https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw

#Mastodon #MastoSec #CVE_2024_23832 #MastoAdmin

@jsq Hi Jesse!
Before talking about Sealed Sender specifically, it's worth calling out that Signal does not send any push content other than a flag that says: “Connect to the Web Socket” and retrieve some messages”. The content is then fetched and decrypted in a Notification Service Extension and then displayed as a local notification to the user.
https://github.com/signalapp/Signal-iOS/blob/b1027b670ea145073b12e5fb5c281a2facd3b61b/SignalNSE/NotificationService.swift#L105
APNS therefore never sees, even the Sealed Sender-encrypted ciphertexts, of the incoming messages.

Ylva Johansson is now claiming that because of the horrifying UK #OnlineSafetyBill the EU would be a safe-heaven for #CSAM ...

It's a race to the bottom on privacy now.