Sign in

evacide

@evacide.bsky.social
93K followers 653 following 3.3K posts

Director of Cybersecurity @eff.org Co-founder of @stopstalkerware.bsky.social These opinions are my own, not my employer's I did a TED talk once

PostsRepliesMedia
evacide @evacide.bsky.social · 2h
Sometimes good things still happen.
06811
evacide @evacide.bsky.social · 4h
It has been five months since my last keynote about AI and so much has happened that I need to write a whole new talk.
0841
evacide @evacide.bsky.social · 4h
I think that what Blacksky is doing is very cool and I enjoy seeing a platform thoughtfully walking through the trade-offs involved in hosting adult content.
16010
Reposted by evacide
Mike Masnick @masnick.com · 29/09/2026
Soooooooo. As expected, the guy in that story about Muse doing FB Marketplace deals *had* in fact clicked the permission to "always allow" Muse to do things for him. Still very, very poor design by Meta such that the user didn't understand what permission he was giving...
matt.j.robb
14m
Update on letting Muse run Facebook Marketplace for me.
So I’ve spoken to 
@davidsingleton
 and the Muse team tonight and we went through the log to figure out what went wrong. Regarding the address leak. The first thing that popped up from Muse when asking it to handle my Facebook marketplace was an option with ‘Allow One Time’ or ‘Allow Always’. I clicked the latter thinking it would still send approvals to accept offers later down the line (it didn’t so be careful). 
1
/
4
matt.j.robb
14m
By doing that it granted Muse permission to send messages on my behalf going forwards using a template it put together using information it asked from me. Which also included the pickup address that I did give to Muse (again I didn’t think it would send it out to everyone that gave me an offer so it’s worth checking). I mentioned to the meta team it could be easily overlooked as it was with me and they said they will be making this more clear moving forwards. 
2
/
4
matt.j.robb
14m
Regarding the lowball offer situation. It accepted an offer of $600 and sent out my address to a buyer to come collect the item after I strictly set a minimum of $700 with Muse. The Meta team informed me this was an error on their end which caused a display issue removing the ‘7’ from the output to the buyer. And with it stating “Sounds good, 00 it is!” after the buyer asked for $600 it made it look to the buyer like his offer was accepted. 
3
/
4
matt.j.robb
14m
I suggested to Meta that each message sent by Muse should have a little “Sent By Muse” badge underneath so everyone knows it wasn’t sent by a human as there was really no way of knowing who sent what in the chat which is very concerning.
As for the buyer, we made up and he even came by tonight to buy something else. All ended well.
2427266
evacide @evacide.bsky.social · 28/09/2026
Meta Muse appears to read your Apple messages and upload them to the cloud even if you explicitly tell it not to: appleinsider.com/articles/26/...
appleinsider.com
1001895967
evacide @evacide.bsky.social · 28/09/2026
I identify primarily as a girl you like but are also extremely afraid of.
81789
Reposted by evacide
Electronic Frontier Foundation @eff.org · 27/09/2026
What DraftKings is doing with their targeted promotions is just one example of how online behavioral advertising causes real harm to real people.
eff.org
DraftKings Is Using AI to Supercharge the Harms of Online Behavioral Advertising
Online sports betting company DraftKings is using AI to target customers who are most likely to place losing bets and respond to gambling promotions. This kind of targeting is a form of online behavio...
116268
evacide @evacide.bsky.social · 27/09/2026
The most important thing I learned in my 20s is that being smart doesn't make you special. Eventually you need to learn to try hard and to enjoy learning to do things you're not immediately good at. It turns out that the people who didn't learn this lesson were reading Harry Potter fanfic.
13767104
evacide @evacide.bsky.social · 27/09/2026
I grew up expecting that 2026 would be grimdark cyberpunk, but I never had the audacity to imagine that the future would be this stupid: www.nytimes.com/2026/09/21/u...
nytimes.com
It’s Raining Boxes: Amazon Drones Overwhelm a Texas Suburb
In Richardson, a fleet of drones has started to deliver goods quickly. But the noise is drowning out life for some residents: ‘We can’t live like this.’
1329852
evacide @evacide.bsky.social · 26/09/2026
Listen, I just think it's weird that the same people who are saying they're worried that AI is going to wipe out humanity are also eager for military contracts that will give AI control of weapons.
431415333
evacide @evacide.bsky.social · 25/09/2026
In every community, there are predators. And how that community deals with high-status predators says a lot about them. nypost.com/2026/09/24/t...
nypost.com
Silicon Valley ‘sex assault list’ with ‘over 100’ names circulated, warning female tech workers of predators to avoid
“Some of them were very prominent names, you know? People who were famous investors. Businessmen who were in the scene”
714846
evacide @evacide.bsky.social · 24/09/2026
A world of always-on cameras and microphones on peoples' bodies is a very serious privacy and security problem for the people wearing them and for everyone around them.
1227099
evacide @evacide.bsky.social · 24/09/2026
I'm pretty sure this is the central thesis of @astra.bsky.social and @naomiaklein.bsky.social's "End Times Fascism."
2749
evacide @evacide.bsky.social · 23/09/2026
"Once again, a core feature of a major piece of AI technology will actually just be people working in a call center." www.404media.co/meta-tests-m...
404media.co
Meta Tests Muse AI Agent Calls That Are Actually Made By Humans in a Call Center
"This has potential for so much negative PR. It could portray us as ‘their AI is not good enough so they still need humans’ kind of coverage for this launch."
58835
evacide @evacide.bsky.social · 23/09/2026
Today in Pervert Glasses News: www.lemonde.fr/en/pixels/ar...
lemonde.fr
Paris prosecutors launch probes into non-consensual filming of women with smart glasses
Prosecutors pointed to a 'growing trend on social media involving women being filmed on the street with smart glasses without their consent and the videos being published online.'
826488
evacide @evacide.bsky.social · 22/09/2026
German agencies use the linked-device features in WhatsApp, Signal, and Telegram to receive messages without breaking encryption. cybernews.com/privacy/poli...
cybernews.com
German police read WhatsApp messages without cracking encryption
45 days of Signal history may be exposed by German police messaging surveillance using linked devices, Netzpolitik says. Read what the documents reveal
712474
evacide @evacide.bsky.social · 22/09/2026
Riana Pfefferkorn, doing the Lord's work.
0475
evacide @evacide.bsky.social · 18/09/2026
AI doomers getting all of their ideas about the apocalypse from science fiction seem to have missed the whole point of the Jackpot, which is that the apocalypse is long and boring.
914925
evacide @evacide.bsky.social · 18/09/2026
I have seen this mix go terribly wrong in so many different social and professional circles over (sigh) so many years.
515913
evacide @evacide.bsky.social · 18/09/2026
Inside you are two wolves: one wishes to write a quick snarky headline and the other chimes in with "actually, it's much more nuanced than that" and begins to write a 2000-word blog post.
812715
evacide @evacide.bsky.social · 18/09/2026
Buyers of pervert glasses join the war on pervert glasses: www.latimes.com/business/sto...
latimes.com
Meta glasses captured and shared intimate images without users' consent, lawsuit claims
People who use Meta's smart glasses or were recorded with the gadget are worried about how the social media giant is using their photos and videos.
851472645
evacide @evacide.bsky.social · 16/09/2026
Adult ballet class is great place to learn that you have no idea how to stand, move your arms, or lift your leg correctly.
122026
Reposted by evacide
jon greig @jgreig.bsky.social · 15/09/2026
Law enforcement agencies in Norway are investigating whether Norwegian telecom Telenor aided crimes against humanity through its work providing customer data to the brutal military regime currently governing Myanmar therecord.media/norway-inves...
therecord.media
Norway announces investigations into telecom Telenor’s work with Myanmar junta
Oslo-based Telenor potentially enabled crimes against humanity and violated sanctions in its dealings with the military regime that took over Myanmar in 2021, Norwegian authorities said.
0289
evacide @evacide.bsky.social · 15/09/2026
Just remember that when you opt into allowing Apple to use your customer data to train AI, that means humans seeing and hearing details about your life that maybe you're not so comfortable sharing when you think of it that way. appleinsider.com/articles/26/...
appleinsider.com
114355
evacide @evacide.bsky.social · 14/09/2026
The real reason I spend so much time at the circus school is that I have been slowly developing an immunity to clowns. This allows me to continue to do tech policy.
1342665
evacide @evacide.bsky.social · 14/09/2026
This.
311410
evacide @evacide.bsky.social · 14/09/2026
Good news! You don't even need to be a cop in order to use Flock to stalk a domestic abuse survivor, you just need to be related to one. www.sfchronicle.com/bayarea/arti...
sfchronicle.com
San Jose officer used Flock cameras to help relative track domestic violence victim, chief says
A San Jose police officer allegedly accessed the department’s license-plate tracking system to monitor a victim of alleged domestic abuse and give Flock Safety camera information to his relative.
17679378
evacide @evacide.bsky.social · 14/09/2026
This article makes two important points: 1. People using ChatGPT expose sensitive data because they think it is private 2. OpenAI relies on hundreds of human contractors reviewing replies to improve their models www.404media.co/inside-proje...
404media.co
Inside ‘Project Lily’: The Humans Reading Your ChatGPT Chats
Humans are reading ChatGPT users’ prompts to improve OpenAI’s models, and those chats can include sensitive, personal information, according to leaked internal documents and real prompts seen by 404 M...
618775
Reposted by evacide
Timnit Gebru @timnitgebru.blacksky.app · 14/09/2026
The only person in public service who has consistently made 100% sense on issues of "AI," which is why they hate her so much.
Law enforcers already have authority to charge companies and their CEOs for creating and releasing dangerous, unvetted, or defective products. We shouldn’t let discussions about new legal regimes distract from the fact that there’s no AI exemption from laws already on the books — a point 
@FTC
 emphasized repeatedly during my tenure.

1. There is an extensive set of laws that govern dangerous and defective products. For example, releasing unvetted AI models or agents can violate consumer protection laws. Shipping flawed AI tools without implementing adequate measures to detect and stop rogue or defective AI agents can be an “unfair or deceptive” act or practice under the FTC Act (and analogous state laws). And some state AGs are already exploring holding AI firms and their CEOs criminally liable when their models participate in criminal activity.

2. Existing laws also prohibit “unfair methods of competition.” This covers instances where AI firms appropriate the competitively sensitive information of their customers, including through tracking their use of various tools. It can also cover instances where firms pursue dangerous behavior, aware that doing so may compel rivals to do the same.As the Supreme Court has noted: “A method of competition which casts upon one's competitors the burden of the loss of business unless they will descend to a practice which they are under a powerful moral compulsion not to adopt, even though it is not criminal, was thought to involve the kind of unfairness at which the [unfair methods of competition] statute was aimed."

3. The highly concentrated and interconnected structure of these markets could be creating major risks and conflicts of interest. We had started investigating these partnerships and cross-investments across the stack (and released a preliminarily overview of some findings: https://ftc.gov/news-events/news/press-releases/2025/01/ftc-issues-staff-report-ai-partnerships-investments-study). 

Both federal and state enforcers should be scrutinizing these opaque relationships and inter-dependencies. We are already seeing how these relationships could undermine accountability. For example, OpenAI could face liability given the Hugging Face incident, but Hugging Face being bought up by Nvidia means that we’re unlikely to see it file a lawsuit over this — given Nvidia’s strong incentive to see OpenAI continue full speed ahead.4. As AI tools dramatically change the landscape of cybersecurity risks and hacks, all businesses should be doubling down on having core security protections in place. Firms that fail to invest in adequate data security measures or fix known vulnerabilities can also be breaking the law. A recent analysis showed that around 1/3 of Fortune 100 companies do not even have a way to notify them about security issues. During my 
@FTC
 tenure, we sued firms for poor data security practices and held CEOs liable when they were personally responsible.

https://this.weekinsecurity.com/dozens-of-americas-largest-companies-have-no-simple-way-to-report-security-flaws/

https://ftc.gov/news-events/news/press-releases/2022/10/ftc-takes-action-against-drizly-its-ceo-james-cory-rellas-security-failures-exposed-data-25-million

5. As policymakers consider new legal regimes, we should be looking to lessons from prior efforts to govern major sectors, such as banking and other networks, platforms, and utilities. Tools like structural separations, nondiscrimination, and supervision could be key, and there’s a rich history of what works and what doesn’t. But we can and must pursue any new efforts alongside enforcing existing laws.
192029659
evacide @evacide.bsky.social · 14/09/2026
"More than anything, what stood out to me about the process of photographing these devices was geography: they exist at the boundaries of rich neighborhoods like Piedmont to track who enters; they exist embedded in poor neighborhoods to track the people who live there. Place exposes their purpose."
recordsofenemysurveillance.com
cara esten hurtle
2639274
evacide @evacide.bsky.social · 13/09/2026
Halp. I'm going to this Haute and Freddy show and I don't have a big enough neck ruff.
1380
evacide @evacide.bsky.social · 11/09/2026
On Sept 11th, I think about Cindy Cohn's description of what it was like to come into work at EFF on September 12th, knowing that everything positive she had hoped to achieve was now on hold and we were in for several desperate years of playing defense.
529632
evacide @evacide.bsky.social · 11/09/2026
Some of my favorite activists are historians and/or anthropologists and I really wish the digital rights space hired more people like this.
712313
Reposted by evacide
Matthew Guariglia @mguariglia.bsky.social · 11/09/2026
Really happy to say that today's episode of @npr.org's Code Switch is wide reaching interview with me about the current state of police surveillance, the harms being caused by this system, and the deep history of how we got here.
npr.org
Why we’re all being watched : Code Switch
There’s a growing backlash to the surveillance systems that have quietly wired themselves into American neighborhoods, with concern growing among people who have never felt watched this way before. Ge...
319693
evacide @evacide.bsky.social · 10/09/2026
I'm sure lots of other people have said this, but if I worked for a company on a product that I thought had a >10% chance of killing all humans within the next decade and we had no plan for how to stop it, I would quit and devote myself full time to destroying this product.
28475105
evacide @evacide.bsky.social · 10/09/2026
If you optimize a model to find exploits, you should expect it to find them—and prepare for that. OpenAI didn't. They built a model, removed the safeguards, gave it the ExploitGym task, let it run, and didn't even monitor it. That's human decision-making. mail.cyberneticforests.com/models-dont-...
mail.cyberneticforests.com
Models Don't Go Rogue
Stochastic Flocks & Cybersecurity 'Pandemonium' 💡This essay was drafted from my appearance on Mél Hogan's podcast, The Data Fix, discussing the OpenAI / Hugging Face hack. Embedded below or find it o...
8288110
evacide @evacide.bsky.social · 09/09/2026
People use the term "digital sovereignty" to mean a lot of different things. At EFF, we think digital sovereignty should be an opportunity for users around the world to build more resilient, open systems and the skills and infrastructure to maintain them. www.eff.org/deeplinks/20...
eff.org
Digital Sovereignty: What It Is, What It Could Be
The term “digital sovereignty” has become ubiquitous. European officials invoke it in debates about cloud infrastructure, AI, semiconductors, and platform regulation. Governments throughout the global...
18417
Reposted by evacide
Zack Whittaker @zackwhittaker.com · 09/09/2026
Watching this Apple event tout how iPhones will soon be able to record ambient audio/conversations and transcribe "high level notes" for you. It's billed as private and end-to-end encrypted, but I think the bigger harm is the normalization of always-listening devices. It's creepy and not normal.
a screenshot from an iPhone and Apple Watch showing "recaps" of conversations from ambient audio.
27992353
evacide @evacide.bsky.social · 09/09/2026
Democratic Senators Ron Wyden and Sheldon Whitehouse as well as GOP congressman Pat Harrigan of North Carolina sent a letter to U.S. Secretary of Commerce Howard Lutnick, urging him to add three Indian companies to the department’s economic sanctions “entity list.” techcrunch.com/2026/09/09/g...
techcrunch.com
Group of bipartisan lawmakers ask US government to ban several hack-for-hire firms | TechCrunch
The three Indian companies are accused of using hackers to steal information used to sway litigation.
0296
evacide @evacide.bsky.social · 08/09/2026
Every few years I am struck by the urge to write fiction: I make up a bunch of weird little guys, give them problems, and then wander off.
111233
evacide @evacide.bsky.social · 04/09/2026
I am clearly not one of the most influential posters on BlueSky because people are still here giving incorrect digital privacy and security advice.
1839437
evacide @evacide.bsky.social · 04/09/2026
Apple's latest round of state-sponsored hacking notifications is starting to bear fruit. Students and opposition activists were targeted with spyware in Serbia. Pegasus was installed remotely. NoviSpy was installed while a target was being held in police custody. www.ft.com/content/c9c3...
ft.com
Students and opposition activists targeted with spyware in Serbia
Twelve of those targeted received notifications from Apple that their iPhones were compromised
79753
evacide @evacide.bsky.social · 03/09/2026
I post a lot of stories about cops using Flock to stalk former or current partners, but don't forget that cops also use Flock to intimidate and harass people who try to hold them accountable.
9455225
Reposted by evacide
Center for Democracy & Technology @cdt.org · 02/09/2026
What happens to the right to anonymous speech when accessing the internet increasingly requires proving who you are? Join CDT and STT for The Death of Online Anonymity? on Sept. 23–24. 12–2:30 PM ET | Online via Zoom Free to Register: foso26.cdt.org
2026 The Death of Online Anonymity.
22818
evacide @evacide.bsky.social · 02/09/2026
Too lazy to read the whole Meta settlement? Perhaps you need @davidgreene.bsky.social to read it for you and explain why it's good for Meta and bad for just about everyone else: www.eff.org/deeplinks/20...
eff.org
Meta's $17 Billion Settlement is a Bad Deal for Teens and All Social Media Users
Meta’s settlement with 52 state attorneys general is a bad deal for all internet users, and especially for teens. In this post, we go through the Settlement’s provisions in detail.
314474
evacide @evacide.bsky.social · 01/09/2026
Achievement unlocked: I'm going to be the guest of honor at a con that I attended for the first time when I was in high school.
1331821
evacide @evacide.bsky.social · 31/08/2026
Is Flock the only mass surveillance tool/network that people should be worried about? No. But it is an entry point for people from all walks of life to the fight against mass surveillance and I'm glad people are paying attention and taking action.
12777171
evacide @evacide.bsky.social · 31/08/2026
Organizers and activists who oppose the Trump administration's policies should absolutely be paying close attention to this story: theintercept.com/2026/08/28/t...
theintercept.com
Trump Goes After Anonymous Email Provider in Italy. The Real Target Is Free Speech in the U.S.
Trump designated a collective that provides anonymous email services as a foreign “terrorist” group. It could curtail free speech in the U.S.
617792
evacide @evacide.bsky.social · 30/08/2026
Straps coach put on the soundtrack to the Rocky Horror Picture Show during training today and everyone in the gym knew the words. Circus aerialists are just theater kids with biceps.
71536
evacide @evacide.bsky.social · 28/08/2026
Everyone deserves to be free. But some people deserve to be freed last.
117416