iiinova — where your digital self keeps evolving

Serge Egelman @v0max.bsky.social · 02/10/2026

I ordered ramen online from Japan! It only took 3.5 months to get here…I might have gotten too much?

12 boxes of ramen stacked up on my porch.

Serge Egelman @v0max.bsky.social · 01/10/2026

The broader context is that he wanted to make people's Facebook statuses publicly searchable, which meant encouraging them to not use privacy settings to make their Facebook status private.

From: Chris Cox
To: Mark Zuckerberg
Sent: Sat Jan 24 09:19:36 2009
Subject: Re: Search PPPMB - 10/23/2006
Yeah I'm on it.
I don't know if the amount will be the vast majority of our users though- that seems like a lot to ask with the
expectation that they still share as much. What percentage were you thinking?
On 1/24/09 1:25 AM, "Mark Zuckerberg" > wrote:
FYI -- Akhil thinks global stream search will be ready in March.
Can you work with Leah to make sure we get all (or the vast majority) of current users to make their statuses
and other stream content public before then?

100

Serge Egelman @v0max.bsky.social · 01/10/2026

Here's a great one: nmdoj.gov/wp-content/u... It's a 2009 email from Mark Zuckerberg, in which he acknowledges that "90%+ of these folks...probably don't understand their current privacy settings."

120

Serge Egelman @v0max.bsky.social · 27/09/2026

You’re demeaning the work of those who actually graduated high school: he dropped out of school after 8th grade. www.nytimes.com/2025/09/12/t...

“He dropped out of school after eighth grade because of chronic health issues, and never returned.”

0211

Serge Egelman @v0max.bsky.social · 23/08/2026

The brewing closet is finally complete! I just set up an old Raspberry Pi to stream stats from my Tilt hydrometers to a tiny OLED display. Next step: setting up Grafana to make a cool dashboard.

Closet filled with brewing equipment. There’s a tiny computer with tiny display zip tied to a shelf.

Closeup of Raspberry Pi and tiny OLED showing temperature and gravity readings.

020

Serge Egelman @v0max.bsky.social · 19/08/2026

Well it’s not wrong… Impressed that it even made it overly verbose, definitely got my card!

Spotted a new "privacy-first" browser that requires you to paste your entire soul into a text box to enable "secure mode." It's the 2026 equivalent of locking the front door while leaving the windows wide open for the data brokers. At least the adtech folks can finally stop pretending that a hash is…

120

Serge Egelman @v0max.bsky.social · 16/07/2026

I just noticed that the IAB OpenRTB spec categorizes "astrology" under "science." www.iab.com/wp-content/u... I guess that's fitting from an organization that has its own unique definitions for terms like "consent" and "choice"...

IAB15 Science
IAB15-1 Astrology
IAB15-2 Biology
IAB15-3 Chemistry
IAB15-4 Geology
IAB15-5 Paranormal Phenomena
IAB15-6 Physics
IAB15-7 Space/Astronomy
IAB15-8 Geography
IAB15-9 Botany
IAB15-10 Weather

001

Serge Egelman @v0max.bsky.social · 03/07/2026

Touching grass and making bo ssam.

View of Lake Alpine between the pines from the campsite.

Giant pork shoulder cooking in a Dutch oven over a campfire.

020

Serge Egelman @v0max.bsky.social · 24/06/2026

Huh, where do I know that name from… www.nytimes.com/interactive/...

In addition to Fun Kid Racing, the tests showed one other Android app sending precise location data to other companies: Masha and the Bear: Free Animal Games for Kids, an animated game app with millions of downloads. The iOS version sent advertising ID codes to a company that generally prohibits children’s apps from using its network.

In an email, Indigo Kids, the Cyprus-based maker of the Masha app, said it was not responsible for harvesting children’s information because third-party companies collected the data. “We, as a company, do not collect or store any data of our users,” the company said.

093

Serge Egelman @v0max.bsky.social · 22/06/2026

The inside is even cooler! (I was there in December 2024.)

Stained glass of Bibendum kicking at the viewer.

100

Serge Egelman @v0max.bsky.social · 19/06/2026

Mine is mostly right…though I regret not making the national team this year!

“GPT-5.5 SAYS
COMPUTER SECURITY AND PRIVACY RESEARCHER KNOWN FOR WORK ON USABLE SECURITY, PRIVACY, AND MOBILE APP DATA PRACTICES.”

“GLM 4.7 FLASH SAYS
FRENCH PROFESSIONAL FOOTBALLER WHO PLAYS AS A FORWARD.”

210

Serge Egelman @v0max.bsky.social · 15/06/2026

…and so it begins again!

Giant flags on the pitch at the beginning of the Belgium-Egypt match.

000

Serge Egelman @v0max.bsky.social · 15/06/2026

…and now on to [redacted] Field!

“Seattle Stadium” with “Lumen” redacted.

120

Serge Egelman @v0max.bsky.social · 12/06/2026

I think I found the right place.

Selfie with the pitch in the background.

Zlatan, Thierry, and Alexi filling time ahead of the match.

140

Serge Egelman @v0max.bsky.social · 12/06/2026

I have finally made it to [redacted] Stadium!

Sofi Stadium sign with Sofi redacted, because they did not bribe FIFA.

010

Serge Egelman @v0max.bsky.social · 11/06/2026

This paper (abstract below) on the lies the adtech/data broker industry tells courts has finally been published: yjolt.org/anonymity-co... Joint work with Joel Reardon at U Calgary and Ken Bamberger and Laurel McGrane at Berkeley Law. 1/

Abstract:
While legal scholars have cited decades of computer science
research that demonstrates why anonymity is hard (and that
datasets should not be labelled as “anonymous” cavalierly),
industry and legal practitioners have not heeded those warnings:
many organizations trafficking in consumer data continue to
assert to customers, courts, and regulators, that their data is
anonymous or “deidentified.” We acquired datasets from
multiple data brokers to demonstrate empirically why this is
false. Using publicly available email addresses found in data
breaches posted on the Internet, we trivially reidentified 88% of
the hashed email addresses that we obtained; using modern
password-cracking techniques, we were able to reidentify 97%
of the 6 million email addresses that we collected. Reidentifying
hashed email addresses need not rely on illicit data or specialized
hardware: by constructing rainbow tables with synthetic data
representative of typical email addresses, we reidentified most of
the hashed email addresses. In all cases, the hashed email
addresses were linked to other device-based identifiers (e.g.,...
1/2

...mobile device advertising IDs, IPs, etc.), demonstrating why
device-based identifiers have long been considered personally
identifiable information.
Relatedly, organizations trafficking in this data make
another assertion, that this data was collected from consumers
with their consent. To evaluate this claim, we performed a survey
(n=369), in which we emailed a subset of the reidentified
individuals in our datasets to recruit them to participate. This
survey asked participants about their recollections of having
provided consent (99% had no recollection) and their feelings
about the sale of their information (94% were opposed, while
77% said they planned to submit deletion requests). Overall, our
study shows that hashed email addresses and device identifiers
do not come close to meeting commonly understood definitions
of “anonymous” or “deidentified” data, and that any notion of
“consent” must also involve a similarly tortured definition. We
argue that this industry and its defenders are not simply
misinformed or indifferent to the veracity of their statements, but
that this is an example of Plato’s “noble lie”: their entire social
order relies on these demonstrably untrue statements being
believed by courts, regulators, policymakers, and the public.

21115

Serge Egelman @v0max.bsky.social · 15/05/2026

Behold, the belt + suspenders of traffic engineering!

Two signs at an intersection: one is a stop sign, the other indicates a roundabout, thereby making the stop sign redundant.

110

Serge Egelman @v0max.bsky.social · 04/05/2026

We have accepted 20 papers, which will be presented over the two days. The tentative program is now online: weis2026.econinfosec.org/program/

A list of accepted papers from: https://weis2026.econinfosec.org/accepted-papers/

100

Serge Egelman @v0max.bsky.social · 25/04/2026

Finally, some uplifting news for once!

Headline from The Guardian: “US millionaire big-game hunter dies after being crushed by elephants”

020

Serge Egelman @v0max.bsky.social · 14/04/2026

Got into a little hometown jam…

020

Serge Egelman @v0max.bsky.social · 29/03/2026

Here’s an example from a company that is well-positioned to know the accurate definitions of words. They explain that they hash emails and share them with adtech to “match it against other anonymized, people-based identifiers – doing this helps us serve you personalized, relevant advertisements.”

Excerpt from https://www.merriam-webster.com/i/privacy-policy

“We also may rely on third-party service providers to do things like: take user-level information, anonymize it through hashing (a hashed email address might look something like this: e820bb4aba5ad74c5a6ff1aca16641f6) and match it against other anonymized, people-based identifiers – doing this helps us serve you personalized, relevant advertisements.”

141

Serge Egelman @v0max.bsky.social · 28/03/2026

Wait, is this a Little Kings joke? :)

Picture of Little Kings tiny tiny beer bottles.

010

Serge Egelman @v0max.bsky.social · 12/01/2026

I feel like there’s an Idi Amin joke hidden in here…

Highlighted section from Idi Amin’s Wikipedia entry:

His full self-bestowed title ultimately became: "His Excellency, President for Life, Field Marshal Al Hadji Doctor Idi Amin Dada, VC, DSO, MC, CBE, Lord of All the Beasts of the Earth and Fishes of the Seas and Conqueror of the British Empire in Africa in General and Uganda in Particular”

261

Serge Egelman @v0max.bsky.social · 05/01/2026

When life gives you salmon roe, make pappardelle!

Bowl of pappardelle with a cream fraiche sauce with lox, salmon roe, and parsley.

010

Serge Egelman @v0max.bsky.social · 01/01/2026

Happy New Year! I made tapas!

An entire iberico de bellota, patatas con aioli, chorizo, bacalau croquettes, cheeses, and asparagus with eggs.

060

Serge Egelman @v0max.bsky.social · 27/12/2025

This reminds me of the pithivier I made a few years ago and absolutely need to do again!

A handsome pathivier, straight out of the oven on a baking sheet.

040

Serge Egelman @v0max.bsky.social · 22/12/2025

They made it illegal to sell lawn darts after one kid died.

“On April 5, 1987, seven-year-old Michele Snow was killed when a dart thrown by her brother's playmate penetrated her skull and caused fatal brain trauma.[8] The darts were purchased as part of a set of various lawn games and had never been played before the incident occurred.[8] Snow's father David began to advocate for a ban on lawn darts, claiming that there was no way to keep children from accessing lawn darts short of a full ban.[8][9] As a partial result of Snow's lobbying, in 1988 the U.S. Consumer Product Safety Commission introduced an outright ban on lawn darts in the U.S.”

072

Serge Egelman @v0max.bsky.social · 07/11/2025

Someone just sent me the PDF this morning…

130

Serge Egelman @v0max.bsky.social · 23/10/2025

New first for me: email from a student saying how they want to do a PhD with me because they really liked my paper titled "XXX"... ...except I've never written a paper with that title. I was going to forward this jokingly to the authors ("I'm getting your email"), only to find no such paper exists.

"My proposed PhD research centers on Privacy and security, mobile computing, particularly exploring how Mobile computing can be strengthened through Usable Security Studies, Privacy Interface Design, Mobile App Auditing. I was especially drawn to your publication on ...And No One Can Hack It: The Uses and Abuses of Cybersecurity Folk Theory, which aligns closely with my current efforts in IT Security, Cybersecurity, AI-assisted threat intelligence, Core Infrastructure, and predictive defense models for enterprise environments."

5166

Serge Egelman @v0max.bsky.social · 01/10/2025

I haven’t looked, so please no one disabuse me of the notion that these are Netflix popups.

010

Serge Egelman @v0max.bsky.social · 18/09/2025

They appear to keep popping back up under different brand names. There are dozens of these under different names, while at the same time, the CPSC keeps posting new recall notices...going back years. One even claims to be endorsed by the CPSC!

Amazon recommendations showing similar dangerously-designed "baby loungers" from different brands.

Three CPSC recall notices for different brands, but the same design.

Two more CPSC recall notices for different brands, but the same design.

010

Serge Egelman @v0max.bsky.social · 13/09/2025

After coming back from Scandinavia yesterday, I decided to try making shrimp skagen at home. #FoodSky

A plate with a tower of shrimp, crab, dill, and roe upon a flattened brioche sandwich (Mt. Tam and truffle honey).

050

Serge Egelman @v0max.bsky.social · 07/09/2025

Sometimes you eat the bear, sometimes the bear eats you… …last night, however, I ate the bear (braised).

A wooden cup filled with stewed bear meat.

010

Serge Egelman @v0max.bsky.social · 06/09/2025

Check out this Christo knock-off…

000

Serge Egelman @v0max.bsky.social · 06/09/2025

(As I type this while sipping a Coke Zero from a cafe in Helsinki.)

A tray on a cafe table with a bottle of Coke Zero, a bottle of water, and two glasses.

000

Serge Egelman @v0max.bsky.social · 05/09/2025

Second time wearing my regalia! I’m currently in Helsinki for a thesis defense. In the Finnish system, I’m officially known as “The Opponent.”

000

Serge Egelman @v0max.bsky.social · 27/08/2025

The new walnut top for my standing desk is almost ready! Just need to attach the drawer fronts today and attach it to the base! …for those wondering what I’ve been doing instead of responding to emails over the past two weeks or so.