标签：#Privacy

Every online Fake Data Generator tool I used had the same quiet flaw: whatever you paste gets POSTed to someone's server. For a Fake Data Generator, that paste is often exactly the sensitive thing — a token, a config, an API response. So I built Fake Data Generator to not do that. Generate fake names, emails, UUIDs, addresses — custom columns, CSV/JSON export. 100% browser-side — and it runs entirely in your browser, so there's nothing to send and nothing to breach. You don't have to take my word for it: open DevTools → Network, use the tool, and watch the tab stay empty. One HTML file, View-Source-able. https://faker.platotools.com/ It's part of platotools.com — a set of single-purpose, client-side dev tools. Feedback and edge-case bug reports very welcome.

If you've been running local models/apps across more than one machine for any length of time, you've probably noticed that everything is served over plain HTTP, whether its the backend llm apis, the front end sites, or whatever other stuff you've tossed in: most of it is HTTP-only out of the box, no TLS option anywhere in sight. On one machine thats usually fine since its all loopback, but the second you spread apps across a few different computers ( which some of us do ), every prompt and every response starts crossing your LAN in plaintext. Is plaintext on your own LAN a huge deal? Honestly... a lot of folks would say it's probably low risk. But the moment you've got guests, other people's phones, or random IoT junk sharing that network, your prompts and the models responses flying around in the clear are more exposure than you'd probably be comfortable with if you sat down and thought about it. So, with that said- I figured Id write up how I've dealt with that, because the textbook answer ( certs ) is annoying enough on a local network that I think a lot of folks just dont bother. This is a lot easier, especially on something like a mac where you can make sure it kicks off automatically via launchd . Why not just do TLS The "correct" answer is to put TLS on everything; HTTPS everywhere. And you can. But walk through what that actually means on a home network full of mixed machines: You stand up your own little CA, then sign a cert for each host ( unless you want to deal with some code just straight up rejecting the cert ). You install and trust that CA on every client. Every browser, every OS trust store, and ( this is the annoying one ) every app that ships its own trust store and ignores the system one. Plenty of python and node apps do that. A lot of these local LLM apps dont even expose a TLS option, so to add it you front them with something like nginx or Caddy, which is now another moving part on every box ( Setting up Caddy is what convinced me to go this

Plus: Hackers use Meta’s AI bots to hack Instagram accounts, Anthropic helps NSA hackers, a decades-long GPS satellite mystery may have been solved, and more.

The deadline to reauthorize Section 702 of the Foreign Intelligence Surveillance Act is coming up a week from now on June 12th, and legislators seem no closer to reaching a deal. If this sounds like deja vu, it's because we've been here before. Congress reauthorized Section 702 in late April - but only for 45 […]

Even if you've done nothing wrong, it's never a good idea to hand your phone to the cops. But international travelers at American airports often have no choice - even if they're US citizens. When Minnesota labor organizer Janette Zahia Corcelius returned home from a three-week trip to Europe in late April, she was detained […]

Your AI vendor says "trust us" with your data. At the end of June, ByteDance's Doubao (豆包) officially ends its free tier and starts charging for API calls. The discussion in developer communities quickly shifted from pricing to a different question: all this data flowing to cloud AI services every day — where exactly does it go? Around the same time, NVIDIA spent significant stage time at GTC 2026 presenting the full-stack confidential computing capabilities of the Vera Rubin architecture. Jensen Huang's message was clear: future AI chips need to keep data encrypted throughout the computation process, making it inaccessible in plaintext to anyone — including the cloud service provider. Two signals pointing to the same trend: data security in AI services has moved from "someone mentioned it once" to "you need to answer this directly." The Data Path Through Cloud AI Is More Complex Than You Think Most developers have a simple mental model of cloud AI: I send a request, the model returns a result, and my data is gone. The actual data flow is more involved. A typical cloud AI call touches these steps: Request data travels over HTTPS to the service endpoint The service may queue the request while waiting for GPU allocation During inference, input data exists in plaintext in server memory After inference, whether inputs/outputs are cached or used for subsequent training depends on the provider's privacy policy Logging systems may record request metadata or partial content At each step, data is potentially accessible. Providers typically say "we don't look at your data" and "your data won't be used for training" in their privacy agreements. These are contractual commitments. You need to trust that they'll honor them. This is the "Trust Me" model. Trust Me vs Verify Yourself If you roughly categorize data protection approaches in AI services, two paradigms emerge: Trust Me Data leaves your device and is processed by a third party. The provider guarantees security through co

Most AI memory features are a black box. The assistant remembers things about your users, but you...

This popular ad blocker app for iPhones, iPads, and Macs can now block ads from loading inside apps, including web browsers, thanks to a new feature in the latest Apple software.

Musk can't be trusted to protect X user privacy, public commenters warn FTC.

A few weeks ago I was on a call sharing my screen, walking a teammate through a prompt I'd been iterating on in ChatGPT. Mid-sentence I scrolled up — and there, three messages back, was a chunk of a customer's data I'd pasted in earlier to debug something. Real email, real account info, sitting right there on a shared screen. Nobody said anything. Maybe nobody noticed. But I noticed, and I spent the rest of the call only half-present, trying to remember everything else still in that thread. If you live in ChatGPT all day, you already know the problem. The thread is your scratchpad. You paste logs, keys, customer rows, half-finished internal docs — things you'd never put in a doc you planned to share. And then someone says "can you share your screen real quick" and suddenly your scratchpad is a presentation. Why the usual advice doesn't work The standard answers are all some version of "be careful": Open a clean tab before sharing. Scroll to the top. Use a separate "demo" account. These fail for the same reason all manual checklists fail under pressure: the moment you actually need them is the moment you're distracted, talking, and not thinking about hygiene. You remember after . The fix has to happen before the screen goes live, and it has to require zero discipline in the moment. What I wanted instead I wanted something that just sat there and blurred sensitive parts of a page automatically, so that even if I forgot, the leak couldn't happen. A few requirements: Local only. Whatever it does, it never sends page content anywhere. A privacy tool that phones home is a contradiction. Before, not after. It blurs while the page renders, not after I've already exposed it. Per-element, not whole-screen. A full black box is useless for a demo. I still need to show the working parts. The interesting technical bit The naive approach is to listen for some "I'm sharing now" signal and react. That's too late — there's a visible frame where the data is exposed before the blur kic

Code reviewed by WIRED uncovered an unreleased face-recognition system embedded in Meta’s smart glasses platform. It’s designed to identify people via biometric data stored on users’ phones.

(yes, its open source. link at the bottom, if u want to skip ahead!) Most "debloat scripts" are a pile of registry edits you run as admin and pray. No preview, no undo, and half of them happily disable Safe Browsing or updates for "performance." For your browser, the most security-sensitive app you run, that's reckless. So I built BraveDebloater with one rule: never make Brave less safe. It clears out the noise like Rewards, Wallet, VPN nags, Leo AI prompts, News, and telemetry such as P3A, Web Discovery, and Chromium metrics. But it flat-out refuses to disable Shields, weaken Safe Browsing, turn off updates, or touch your hosts file. That isn't a README promise. It's enforced in the tool itself. A few things that make it trustworthy: Dry-run by default. Nothing changes until you explicitly apply. Official Brave/Chromium enterprise policies, so every change is visible and auditable in brave://policy instead of hidden. Automatic backups before any change, written safely so you never end up with a corrupted file. Validated restore that checks the backup before writing anything and only touches Brave's own policy and profile files. Doctor mode, a read-only health check of your current policy state with no writes. It's MIT-licensed, PowerShell 5.1 compatible, and has a few beginner-friendly issues open. If you care about privacy or Windows tooling, I'd love a star and a PR. Check it out at: https://github.com/osfv/BraveDebloater

PewDiePie launching an open-source AI project sounds like one of those internet headlines you have to read twice. But it is real. Felix Kjellberg, better known as PewDiePie, has released a project called Odysseus through the GitHub account pewdiepie-archdaemon. The repo describes it as a self-hosted AI workspace, and the pitch is simple: give people something that feels closer to ChatGPT or Claude, but runs under their control. That is the part that makes this more interesting than a celebrity side project. Odysseus is not just another chatbot wrapper. It is a statement about where personal AI could go if users start caring less about convenience and more about ownership. What is Odysseus? Odysseus is a free, open-source, self-hosted AI workspace. The project says it is meant to recreate the web UI experience people get from ChatGPT and Claude, but with a local-first and privacy-first approach. In the README, the project describes itself as running on your own hardware, with your own data, and “no trojan.” The landing page calls it “A Self-Hosted AI Workspace.” The GitHub repo is licensed under MIT, which means people can inspect it, run it, modify it, and build on top of it. As of June 4, 2026, the repo had more than 44,000 GitHub stars. That is a massive amount of attention for a project that was created on May 31, 2026. Some of that is obviously PewDiePie's name. But the reaction also says something about the moment we are in: people want AI tools, but they are increasingly uncomfortable with how much those tools depend on cloud platforms and private company servers. Why did PewDiePie build it? The short version: control. In his launch video, titled “MY trillion $Dollar Project is finally OUT!”, PewDiePie presents Odysseus as an alternative to the big AI platforms people already use. Coverage from Gizmodo quotes him promising “no tracking, no subscriptions, no funny business. It's yours and yours forever.” The Business Standard also framed the launch around a pus

Four people suing Elon Musk's AI firm under pseudonyms due to the risks of being identified may face a difficult choice: Reveal your real names, or drop the lawsuit.

Fight the scourge of unsolicited rings and pings from spammers, scammers, and telemarketers.

I put my family on a private social network, and all I got was this lousy group chat. At least it’s secure.

We run Quackr, a virtual phone number platform that lets developers and individuals receive SMS verifications without exposing a real number. We just published our first inventory transparency report and the data was surprising enough that we thought the dev community would find it useful. The Numbers Right now, 97.6% of our entire virtual phone number inventory is actively rented. 66,214 out of 67,815 numbers assigned and in use across 15+ countries. Over 1,000 numbers available at any given moment but they move fast. That utilisation rate tells you something about how the market has shifted. Virtual numbers are no longer a niche throwaway tool. Developers, businesses, and privacy-conscious users are holding them long term. What Developers Actually Use Virtual Numbers For The obvious use case is SMS verification during testing. Spin up a number, verify an account in staging, move on. But that is not what drives the bulk of demand on our platform. The real volume comes from: Multi-account management — developers and businesses running multiple instances of platforms that require unique phone verification per account. Privacy layers in production apps — applications that need to verify users without collecting their real numbers. A virtual number sits between the user and the platform. Automated verification pipelines — this is where our API and MCP Server come in. If you need to provision numbers programmatically and retrieve OTPs without manual intervention, this is the use case we built for. Geographic flexibility — needing a UK number from Australia, a US number from Ukraine, or any combination that your real SIM cannot provide. The OTP Blocking Problem Something worth knowing if you are building anything that involves SMS verification: platform-level VoIP blocking has become significantly more aggressive over the past two years. WhatsApp, Telegram, Google, and TikTok all run detection on incoming verification requests. A VoIP number gets flagged and the OTP simp

Most developer tools in 2026 want your data. They want you to create an account, sync to the cloud, share analytics, and join a team plan. Every new tool is another service that knows what you are working on. I wanted something different. CodeFootprint CodeFootprint is a Mac app that tracks file changes in your project folders. It records every edit with full diff, every deletion with recoverable content, and precise timelines for everything. And it does all of this without ever connecting to the internet. How It Works Select a folder to monitor Code as normal — CodeFootprint records in the background Open it anytime to see what changed, when, and how Export change traces to share with AI tools for debugging The Design Decision I made a deliberate choice: no accounts, no cloud, no telemetry, no data leaving your machine. Not because cloud is bad, but because your project files are some of the most sensitive data you own. Your code, your configs, your unpublished work — a file change tracker sees all of it. A tool that watches everything you change should be trustworthy by design, not by promise. For Developers Who Use AI Tools If you work with multiple AI coding tools, CodeFootprint gives you something valuable: a shared context you can export. Instead of manually explaining to each new AI tool what happened in your project, you hand it a trace file and say "here is the history." Available Now CodeFootprint is on the Mac App Store . No account needed. No internet required. Your files stay on your machine. More convenience. More protection. More peace of mind.

Available for Android 12 and later, the anti-scam feature is baked into Google Dialer, which sends a silent “confirmation signal” to ensure whoever’s calling you is who they appear to be.

The class action lawsuit, filed in Seattle by Virginia resident Charles Sigwalt, claims that Ring's Familiar Faces feature stores images of passersby without consent.