Kevin Boone says all system-level Android ad blocking works by overriding DNS, and that it is not in Google's interest to make it easy. AdAway states Google Play removed it, so it ships via F-Droid. Boone warns a rogue DNS, VPN or blocker app can see all traffic, and advises open source only.
Search
7 results for “technotenshi”
-
OpenSSH 10.6 (2026-10-06) says it has received a large number of security reports, many from AI models or AI assistance, and that bugs found by AI tools have in some cases been independently found by a different researcher, which the team says suggests adversaries who do not report bugs can find them too, so it will make more frequent releases for now. Fixes include sftp path validation so a malicious server could not steer a recursive copy into writing outside its target directory, sshd not fully honoring the authorized_keys "restrict" keyword for tunnel forwarding (PermitTunnel, disabled by default), GSSAPI credentials persisting after a failed authentication, and ssh refusing "$" and "\" in command-line usernames to block injection via ProxyCommand or Match exec. The LZ77 dictionary coder is now disabled in ssh and sshd to mitigate the compression side channel described in the Baumer and Brinkmann preprint "Crossing the Streams", so compression will be less effective. The release also enables the hybrid post-quantum ssh-mldsa44-ed25519 signature algorithm, requires regenerating keys from the earlier experimental support, and begins deprecating scp -R.
-
Psiphon, a Toronto censorship circumvention tool spun out of the Citizen Lab with about 20 million monthly users, says it has started planning to leave Canada if Bill C-22, now before the Senate, passes as written, and that it must assume it would be covered because the bill leaves which providers face surveillance obligations to be defined after passage. VP Kenzie Elsworthy told The Globe and Mail that a secret access capability cannot be hidden in public open source code: "It is a published vulnerability." Public Safety Minister Gary Anandasangaree calls the bill "the right balance" and expects it to pass in its existing form, and his office says most service providers will not face obligations, while Ottawa gave Psiphon about $600,000 in National Research Council funding this year. Citizen Lab director Ron Deibert says the bill "will make it impossible for a large number of invaluable privacy-preserving tools and applications from operating in Canada."
https://citizenlab.ca/toronto-based-vpn-provider-plans-to-quit-canada-over-lawful-access-bill/
-
German federal prosecutors say former BND president August Hanning, 80, was arrested on 6 October 2026 on strong suspicion of treasonous espionage, spying out state secrets, attempted treason and espionage. They allege his former chief of staff Manfred D., who worked for later BND presidents until March 2026, supplied him with about 2,000 documents for payment, many classified, with current findings pointing to June 2022, and that Hanning used the material in private consulting. Prosecutors say Hanning once used classified intelligence to draft an analysis for an officer of a foreign intelligence service and passed political information to a representative of another, but they have not named the services or established whether the analysis reached its recipient. The case emerged from a September 2025 search in a Hamburg investigation and was handed to federal prosecutors in early May 2026; both men are suspects and no verdict has been reached.
-
Developer David Bushell says he moved his static site generator from Deno to Node v26.10.0 with small changes, swapping Deno's file system and server APIs for node:fs and Hono's Node adapter, and reports 15% faster builds (his own measurement). He pairs Node with pnpm, which since v10 disables dependency postinstall scripts by default, plus a one day delay on new package releases as protection against freshly published malware. Node's docs say it refuses to handle TypeScript files under node_modules "to discourage package authors from publishing packages written in TypeScript," which Bushell calls a philosophical rather than technical restriction. He cites broken ZSH integration, JSR rate limit errors and concurrent HTTP request bugs as what finally pushed him off Deno.
-
IANA changed example.com on 28 September 2026 from a static English page to a basic HTML page plus a separate JavaScript file that adds the notice in Arabic, Chinese, French, Russian and Spanish, according to DebugBear's change history. IANA says the split reduces bandwidth because most traffic is automated and does not fetch the script. IANA also states the domain exists for documentation examples, is not "a general purpose endpoint for things like availability testing," and that its web service is provided "as best effort" with a strong recommendation not to design applications that need an HTTP service there.
https://www.debugbear.com/blog/example-dot-com-redesign-history
-
Meta CEO Mark Zuckerberg said its Muse AI agent was "built from the ground up for privacy and security," but researcher Patrick Wardle found a zero day that let any local app or terminal command on macOS capture a user's Muse account token by redirecting dictation to an attacker's server; Meta says it has issued a hotfix. 404 Media reports internal posts show a weeks long hardening push over a spike in "KVM escapes," at least one of which could have exposed internal Meta databases, and an anonymous Meta source said many senior engineers expect "a massive data breach" and called the fixes "half-baked protections." Apple has since changed macOS Full Disk Access controls after columnist Jason Aten said Muse referenced a Messages thread it had no permission to read, which Meta disputes. Wired also reports Muse builds detailed profiles of users' friends and family, which CDT's Miranda Bogen says will balloon what companies know about users.
https://www.techdirt.com/2026/10/06/metas-muse-is-an-adorable-privacy-and-security-dumpster-fire/