Avatar
Seanz
bbd5c1b0fb0eba8e7b379da2f8c03c3a1954edf6ebcbae0ac1a7e414781b6fe3

eventually, they will have to add so many plates and bend them in so many directions to explain all the observations that they will come up with a sphere made of plates.

if you live where I live, you can just go outside in a t shirt 5 months out of the year.

I'm down to like 5 apps on my main profile. proton mail etc and on my alt profile I have shit like security cams and the like. I use my phone so much less and Google collects almost nothing about me. feels goooooood.

This is a fake story: https://x.com/cryps1s/status/1824077327577591827

Turns out that getting security information from the CISO of a mass surveillance company trying to build a dystopian police state providing police with "predictive policing" software largely based on racial stereotypes is a bad move.

Trail of Bits iVerify EDR product runs in the standard app sandbox on iOS and Android. It can hardly do anything beyond static scanning of APKs. It's a crippled antivirus app marketed as detecting sophisticated attackers. It's a scam and Trail of Bits has lost all credibility. Trail of Bits is working closely with Palantir and is focused on getting government contracts. They've created a fake news story to promote their EDR product which has been propagated across mainstream media. Journalists didn't do basic due diligence and spread false marketing.

Verizon has a suite of low-level apps for Android devices to fully use their network. These are included on any Android device with full Verizon support. Pixels disable the packages unless a Verizon SIM is active. This is equivalent to having them installed/uninstalled on demand. One of the apps in this suite is the Showcase retail demo app for Verizon to show off phones in their store. It requires manually up the phone as a retail demo device. Verizon says they don't use it anymore. This demo app is where Trail of Bits / iVerify found an HTTP connection.

In order to exploit Verizon's demo app not verifying a signature for the downloaded config or even fetching it via HTTPS, it would already need to be set up to use retail demo mode. The contractors Verizon paid to implement it did a bad job, but it's not a Pixel security issue. Since it's an obsolete app that Verizon isn't using anymore, the stock Pixel OS already removed it in Android 15 which is visible in the Android 15 Beta. The other Verizon apps needed to fully use their network which get activated with a Verizon SIM are of course still included.

#GrapheneOS has been omitting these carrier apps since around 2015. This meant GrapheneOS users weren't able to use Sprint and can't use certain features on Verizon like Wi-Fi calling. Apple has a special deal with Verizon and implements what the control they want as part of iOS. The restrictions set in Verizon's carrier configuration and the functionality implemented by these apps is a major part of why they prevent installing an alternate OS on any device sold by Verizon. They want to control how people use features like tethering and Wi-Fi calling.

Every month, a bunch of real vulnerabilities are patched for Android on Pixels. A subset of these including all High and Critical severity issues in Android itself get backported to older Android releases for non-Pixels too. iVerify's finding isn't even a Low severity issue. Supposedly reputable news organizations including the Washington Post, New York Times, Wired, etc. are largely acting as press release distribution service for governments and corporations. If it fits a narrative they want to tell, there's no attempt to question or confirm it.

Trail of Bits employees should think over whether they want to be part of building a police state with pervasive surveillance as Palantir partners. You're not even working at a reputable security company anymore. Trail of Bits has become the charlatans they used to criticize.

#security #privacy

that's what I call an ass ripping

I live in the People's Republic of New York. I am struggling to find a decent place to buy crypto. Do I even attempt no KYC? Is it difficult? I can'tuser River.com as they haven't the permission of the regulatory gods. Any suggestions?

exactly right. those that refuse to go beyond surface logic always slide towards authoritarianism. those without real principles.

That's you. That's literally you.

I follow you. And I am tangentially aware of what your talking about. My joke was more about the ease and expertise with which you are both conversing about it. And how it sounds to an outsider. a gift I have that many lack is knowing what I don't know but grasping the fringes of a topic. The gift I often lack is the perseverance to learn more haha. Nothing a little adderall won't fix.