The Tortoise
Joined March 2026
- Tweets1.5K
- Following508
- Followers86
- Likes2.5K
recursive_wave retweeted
Claude now determines what public information you're allowed to have.
This is a perfectly legitimate task, and I haven't suggested nor asked for anything nefarious. It's just information gathering.
Claude has decided I'm not allowed to have that (public) information.
recursive_wave retweeted
If you've ever wondered why smart TVs are so cheap, this is why.
@log4j rooted his Samsung and found an always-on hot mic, automatic content recognition, geolocation, network mapping, ad targeting and user profiling, shared with Samsung's "400 partners".
A lot of it can be blocked in <15 min, wrote a basic guide below.
What your TV is doing
The main culprit is ACR (automatic content recognition). Your TV screenshots what's on screen, fingerprints it, and sends it home to build your ad profile. Samsung does it every 500ms, LG every 10ms [1].
What is insane: it happens on connected devices too.
Plug in your laptop, your console, your work machine, and your TV can fingerprint that via HDMI [1].
He also found that if your Samsung doesn't have a mic, it'll look for one from a connected soundbar or bluetooth device.
xitter.cf/log4j/status/211376224…
It's on by default, and you likely agreed to it on the setup screen you clicked through in 10 seconds.
Step 1: Turn off ACR
Samsung: Terms & Privacy → Viewing Information Services
LG: Live Plus
Vizio: Viewing Data
Roku: "Use info from TV inputs"
Sony/Google TV: Samba Interactive TV
Menus vary by model, but those are the names to look for. While you're in there, opt out of interest-based ads, reset your advertising ID, decline every optional privacy agreement, turn off voice recognition, and delete apps you never open.
Step 2: Give smart devices their own network
Put the TV, cameras, speakers and vacuum on your router's guest/IoT network. The logic is simple: these devices rarely get patched. If one gets compromised (getting drastically more frequent with AI), it shouldn't be able to see your other devices or home network.
Step 3: Block trackers for the whole house with DNS-level filtering
NextDNS (cloud-based) is easy and has a solid free plan. Pi-hole is a little bit more work if you prefer self hosting. For simplicity we'll focus on the former.
1. Sign up at nextdns.io (free tier is plenty)
2. Privacy tab: add a blocklist (OISD is a good bet) and turn on Native Tracking Protection for Samsung, LG, Roku, Amazon (see attached image)
3. Setup tab: copy your endpoint
4. Paste it into your router's DNS settings as DNS-over-HTTPS/TLS (or use the IPs + "Link IP" if your router only does plain DNS)
5. Bonus: block outbound port 53 except to your router. Some devices hardcode their own DNS to get around you
Then open the NextDNS logs and watch how often your TV phones home. It's eye-opening. If an app or update breaks, find the domain in the logs and allowlist it.
Why they do this
TV prices are down 97% since 2000 [2]. Most of that is better manufacturing and brutal competition. But once margins on the hardware hit zero, the cost moved to you.
In Q3 2024, Vizio lost $6.7M selling TVs and made $115.8M in gross profit from ads and viewing data [3]. They've said on earnings calls that they keep TV prices low to grow the audience they sell to advertisers. Walmart bought them in 2024.
This isn't a conspiracy theory either. Vizio paid $2.2M to the FTC in 2017 for tracking 11 million TVs without consent. Last December, Texas sued Samsung, LG, Sony, Hisense and TCL over ACR. Samsung and LG have since agreed to stop collecting that data without explicit consent [4].
TL;DR
1. ACR off
2. Ads + voice off
3. Smart devices on their own network
4. NextDNS filtering on the router
Sources:
[1] ACR study: arxiv.org/abs/2409.06203
[2] Cost of US consumer goods: aei.org/economics/chart-of-t…
[3] Vizio Q3 2024: sec.gov/Archives/edgar/data/…
[4] Texas v. Samsung: texasattorneygeneral.gov/new…
recursive_wave retweeted
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
recursive_wave retweeted
Heads up - don't update your DGX Spark until there's been a bit of time to work out whatever is going on...
Is a significant proportion of the web going to become attacker infrastructure given that most PHP admins are going to be slow on the uptake?
recursive_wave retweeted
Calif was founded with a mission to make the Internet a more secure place for everyone. In the last few months, we have been seeing significant advances in AI model capabilities, especially in the domain of offensive security research. In addition to publishing our research and learnings, we wondered what else we could do to help defenders.
While large corporations and government agencies have the dedicated budget and human resources for incident response and forensics, there are non-profit organizations –- collectively known as civil society organizations –- investigating digital threats affecting vulnerable groups and they are funded entirely by volunteers. In order to perform their job, the civil society researchers may need to extract data from mobile devices for forensic purposes, reverse engineer malware, and conduct similar security tasks. This work can be challenging given the restricted environments on some mobile devices.
We understand these technical challenges and will offer our research services and capabilities to these organizations, free of charge. We support them and their mission.
If you represent such an organization and need assistance, contact us at help@calif.io.
This is a great book. O’Reilly books have a habit (I guess an editorial brand) of 1st chapters that are verbose and don’t pull you in straight away.
This one does too, but I’m glad I kept reading because it is great. Congratulations to the author.
I “get it” now.
recursive_wave retweeted
Anthropic wants to help regulators write the regulations that Anthropic and its competitors must comply with. That gives an AI company the opportunity to shape legislation in its own commercial interests while presenting itself as an authority on AI safety.
🛎️ This was predicted.
AI companies have enormous financial incentives to influence the regulations governing their actions. Their public statements aren’t independent safety advice. They’re corporate communications designed to influence governments, regulators and public opinion.
This should help demonstrate why journalists need to stop repeating everything AI companies say as though it’s objective technical advice. They should investigate who’s making claims, what they stand to gain and if there’s evidence supports them. Otherwise, they’re simply amplifying a PR campaign created by tech companies they’re supposed to hold accountable.
Can anyone old enough to remember TechCrunch or WIRED in their heyday imagine either publication simply repeating what tech companies said without challenging their claims?
Assume everything AI companies say is self-serving and designed to manipulate markets for their own financial gain. These are not companies building technology for the betterment of humanity.
AI is incredible and can do extraordinary things when used properly. But don’t confuse good technology with good people.
Anthropic quietly pitches its own AI safety bill to lawmakers politi.co/4zxDFhl
Is Teresa May the only Prime Minister that hasn't sold out to corporate interests post- being in post since at least before Tony Blair or have I missed some news?
Keir's next gig? Plumber maybe.
Can't forget Nick, George and Tom et al.
@RestIsPolitics @TheNewsAgents
recursive_wave retweeted
The ideal outcome for science isn't a couple of labs using proprietary models and millions of dollars to crack trophy problems, it's to have millions of AI-aided human scientists who follow their curiosity and become way more ambitious
So many product launches in my feed with amazing visuals and I still have absolutely no idea what the do or how they work after watching them.
If you could have any person in the world read any book in the world tomorrow, which person and what book?
The open source projects that attract people’s
- time
- token spend, and
- passion
must have something about them.
I don’t get projects that don’t accept AI PRs.
I understand the reasoning, I just think it’s such a lost opportunity to be part of solving a deeper problem.