标签：#privacy

In the open source world, we often say that "your code is your resume." However, what many developers forget is that every time they run a git push , they're handing over much more than just lines of code. They're delivering a permanent digital trail that can be tracked, analyzed, and used against them years later. This article is an educational guide about privacy in Git and how the metadata you generate every second can compromise your security and your professional future. The command that reveals your "naked identity" If you want to see exactly what you're sharing with the world, open your terminal in any repository and run the following command: git log --format = fuller Unlike the standard log, the fuller format breaks down the complete anatomy of your contributions. This is where most developers are shocked to see what they're actually leaking: 1. Name and Email (Direct Exposure) Git stores your user.name and user.email locally in every commit. This data: Is harvested by spam bots for marketing databases. Allows recruiters to map all your historical activity, even on projects you no longer represent. Exposes you to doxxing attacks if you contribute to controversial projects. 2. Dates and Timestamps (Time Analysis) Git not only saves the day, but also the exact second and time zone of the authorship and commit. This allows you to create an activity pattern : What time do you usually code? Are you working on personal projects during office hours? What geographical area are you actually in? 3. File Patterns and Metadata In addition to text, if you upload binaries (PDFs or images), these usually contain EXIF ​​metadata (GPS coordinates, camera model, etc.) that Git doesn't clean up by default. The Problem with "Permanent Logs" GitHub is, by design, an accountability platform, not a privacy one. Once a commit enters the public history, deleting it is extremely difficult and often pointless if the repository has already been cloned or indexed by third-party service

Papa Johns is spying on people’s buying activities to predict when they are low on food: The pizza chain recently tapped NBCUniversal, Instacart and the dentsu-owned media agency Carat for help reaching consumers when they’re low on groceries—and thus more likely to be swayed by a mouth-watering ad. The idea is to reach hungry consumers by “knowing what is in their fridge without being too creepy,” said Carrie Drinkwater, chief investment officer at Carat. To achieve that goal, NBCU and Instacart created a custom audience of shoppers who regularly purchase grocery staples on Instacart, such as eggs, milk, meat and produce. Based on that data, Papa Johns can determine which days of the week certain consumers are likely to run out of groceries and serve them an ad on NBCU streaming content accordingly. The brand served custom creatives to consumers based on their food preferences—such as whether they buy meat regularly—with QR codes and calls to action such as, “Light on groceries?” or “Empty fridge?”...

"Privacy by design" is one of those phrases you read everywhere and rarely understand. It is often treated as a document to attach to a project, a box to tick before going live. In reality it is not a piece of paperwork: it is the way software is conceived and built from the very first line, so that it protects people's data without anyone having to remember to do so afterwards. What the GDPR actually says The principle is written plainly in Article 25 of the GDPR, which speaks of "data protection by design and by default". These are two distinct things. Protection by design concerns the choices made while the system is being built. Protection by default concerns how the system behaves the moment it is switched on, before anyone touches a single setting. The law does not mandate a specific technology. It asks for an outcome: that data protection be built into the system, proportionate to the risks, and not bolted on afterwards as a patch. It is a difference of substance, not of form. A well-designed system does not have to chase compliance: it already has it inside. It is not a document, it is an architecture The most common mistake is to reduce privacy by design to a file. A report is written, filed, and the building goes on exactly as before. But a PDF protects no data. What protects data are the technical decisions: what information is collected, where it is stored, who can see it, how long it stays, what happens when it is no longer needed. These decisions are made at design time, and changing them later costs far more than getting them right at the start. The principles, turned into concrete choices Privacy by design becomes useful only when it stops being a slogan and turns into a series of choices. Translated into practice, the principles sound like this. Minimisation. You collect only the data genuinely needed to deliver the service. A field you do not collect does not need protecting, cannot be lost in a breach, does not need keeping. The safest piece of da

The Financial Times has a good article on how AI is changing the capabilities of video surveillance, with information from both Israel/Iran and Russia. I wrote about this sort of thing a few years ago, how AI enables mass spying in the way that computers and networks enabled mass surveillance. The interesting development in the article is that AI allows people to ask natural language questions about video footage to AIs—and AIs can answer them. In contrast with older tools restricted to a few dozen preset searches, these new tools allow an almost unlimited range of enquiries by enabling language-based searches on video...

I analyzed what happens when you upload a photo to 5 popular free image compression sites. The Test I uploaded a 4.2MB photo to each service and monitored network requests. Results: Service A : File sent to their CDN (AWS us-east-1). 12 analytics trackers fired simultaneously. Service B : File uploaded, but 5 minutes later a second request sent the file to a different domain. Service C : Cleanest of the five, but their privacy policy reserves the right to "use uploaded content to improve compression algorithms." Service D : 23 third-party scripts loaded on the page. Your image URL is accessible to all of them. Service E : Actually clean — only one request to their server for processing. Only one of five didn't leak data to third parties. One. The Alternative I built compress2png.com to test whether image compression could work without any server. Turns out Canvas API + clever JavaScript handles it: Resize images client-side before export Strip EXIF/metadata in the browser Convert to optimal formats based on content For format-specific needs, svg2png.org handles vector conversion and webp2png.io handles next-gen format conversion — all browser-local. Check the Network tab next time you use a "free" online tool. You might be surprised what you find.

Most of us share files constantly: config files, API specs, design assets, build artifacts. And most of us don't think too hard about where they end up. That's exactly what Zero-Knowledge Architecture (ZKA) is designed to address. But the term gets thrown around loosely, so let's break down what it actually means — and what to look for. The Core Idea: The Server Shouldn't Have to Trust You Traditional cloud storage works roughly like this: You upload a file The server encrypts it (or doesn't) The server holds the key You trust them not to look Zero-knowledge flips this entirely. In a true ZKA system: Encryption happens on your device , before data leaves your control The keys never leave your side — the server never sees them The server handles only encrypted blobs — it's a pipe, not a vault The phrase you'll hear is: "We can't read your data even if we wanted to." That's the point. Why This Actually Matters Here's a concrete scenario: you're sharing a .env file with a contractor. You use a cloud service. The service gets breached a week later. With standard encryption (server holds the key): the attacker potentially has your secrets. With ZKA: the attacker has an encrypted blob that's useless without the key they never had. Beyond breach scenarios, ZKA also helps with: Regulatory compliance — GDPR, HIPAA, and similar frameworks become easier to demonstrate when the service provider has zero access to the data Reduced trust surface — you're not trusting the company, their employees, or anyone who might compel them legally What Real ZKA Looks Like in Practice There's a big difference between claiming zero-knowledge and actually implementing it. Here's what to look for: ✅ Client-side encryption Files should be encrypted in the browser or app before upload. Not on the server. If encryption happens server-side, it's not zero-knowledge — it's just encrypted storage. ✅ Key management stays with you Where do the keys come from? How are they shared with recipients? In a rea

The EU wants Google to share search data with competitors and open up AI on Android, but Google alleges major privacy risks.

The Supreme Court's decision to limit geofence warrants is a win for privacy advocates, who called their use unconstitutional but sought an outright ban.

Most of the time, when I need to inspect a complex JSON payload, I copy the raw string from my terminal or network tab, open a browser tab, and paste it into one of the many "JSON Formatter" sites that clutter the first page of Google. It’s a ritual we all do. We paste, we click "Format," and we wait. For small payloads, this is fine. But when you are debugging a massive API response, a deeply nested configuration file, or a large dataset, that ritual breaks down. The browser freezes. The site asks you to upload a file. Worse, many of these tools send your data to a server for processing. If that JSON contains API keys, user PII, or internal schema definitions, you are essentially trusting a third-party service with your proprietary data every time you hit "pretty print." I got tired of the latency and the privacy overhead. So I built JSONForge . The core premise is simple: do everything locally. No server-side processing. No file uploads. No network requests for the core logic. Everything happens in your browser, powered by WebGPU for heavy lifting and a small model that runs in your browser for schema inference. The WebGPU Advantage JSON parsing is computationally cheap for a modern CPU, but rendering and diffing large structures is not. When you have a 5MB JSON file, the DOM manipulation required to display it as a tree view can cause significant jank. By offloading the parsing and formatting logic to the GPU via WebGPU, JSONForge handles massive payloads without blocking the main thread. You can open a file, click "Pretty Print," and see the result instantly, even if the file is hundreds of kilobytes or larger. The UI remains responsive because the heavy computation is parallelized on the graphics card. This also means the tool works offline. If you are on a plane, or your internet drops in the middle of a debugging session, your toolkit doesn’t vanish. You can continue to diff, validate, and format without interruption. Schema Generation Without the Server Roun

Europe’s pro-competition proposals could see Google Search and Android systems opened up. The company claims there are serious privacy flaws.

Everyone is sick of spam calls and creeper sites that show weirdos where you live—but can any service solve it?

Plus: Former national security advisor John Bolton pleads guilty in classified-materials case, Microsoft helps take down major infostealer infrastructure, and more.

Exposed records from the private group included the personal information of a senior White House intelligence official and an active-duty special operations officer.

Peter Diamandis is the latest tech executive to argue that global surveillance will make the world a better place, following Larry Ellison's comments in 2024.

As UK police embrace the AI revolution, a WIRED investigation reveals the messy inside story of one region’s experiment with predictive analytics.

Security researchers found evidence that Russian authorities hacked the iPhone of a political opponent using a phone-unlocking device made by Cellebrite, even after the company said it would stop selling to Putin’s government.

The Big Lie in Mobile Privacy (And How We Fixed It) If you have an Android phone, you've seen the pop-up banners asking for your permission to track your data. You click "Reject All," assuming the app stops tracking you. Here is the dirty secret of the mobile app industry: It usually doesn't stop them. 🔍 The Pipeline Problem Traditional privacy tools are built like internet filters. When an app tries to send your data across the web to a data company, the privacy tool tries to block that specific web traffic. There is a massive flaw in this approach: The moment you open an app, hidden tracking packages (called SDKs) wake up instantly. They immediately copy your phone's ID, your location, and your usage habits into their internal memory. Even if a network filter blocks them from sending it right now, your data is already collected. The trackers just wait until the filter drops, or they find a workaround to leak it out later. You are forced to blindly trust that these third-party trackers will behave themselves. Spoiler alert: they don't. 🔒 CookiePrime: Locking the Front Door At CookiePrime, we got tired of the "illusion" of privacy. Founded by privacy industry veterans who witnessed how easily corporate trackers bypass traditional regulations, we decided to build a true privacy enforcement ecosystem . Instead of trying to catch your data as it flies out over the internet, our Android software stops trackers from waking up in the first place. Think of trackers like uninvited snoops at a party: Traditional tools try to grab the snoop's notebook after they've walked around your house and written down your secrets. CookiePrime locks the front door so the snoop never steps inside. The moment a CookiePrime-protected app starts, our engine runs a lightning-fast sweep — taking just 93 milliseconds — to identify every tracking script hidden inside the app. If a user says "No Tracking," CookiePrime instantly freezes those specific trackers on the spot. They can't collect data,

The private events group, cofounded by Peter Thiel, says a “criminal” hacker is behind a breach that exposed members’ personal details. WIRED found no evidence a break-in was needed to access the files.

I'm 16, from Pune, India. For the past couple of years I've been building O-AI — a fully local AI desktop assistant. No cloud. No API keys. No data leaving your machine. Everything runs on your own GPU. Why I built it Every AI assistant I tried sent data somewhere. ChatGPT, Copilot, Gemini — all cloud. I wanted something that felt like JARVIS from Iron Man: smart, fast, personal, and private. So I built it from scratch. What O-AI can do Core engine: Runs LLMs fully on-device via llama.cpp / Ollama (zero internet required) Self-learning core — extracts facts from every conversation and stores them permanently Fine-tuning pipeline — train the model on your own data, locally Voice & language: Voice control in English, Hindi, and Marathi via Whisper (running locally) Responds in whatever language you speak Modes: JARVIS mode — arc-reactor HUD, 4 reactive states, British-male voice, "sir" persona Take Over PC mode — full desktop automation Animated floating desktop pet (4 types, draggable, reacts to voice) 30+ automation fast-paths: open apps, search the web, control media, screen vision, run code, edit files, cursor control, social media steps, clipboard ops... Multi-step agent system: plan → execute → verify loop with 14+ step types (web_search, fetch_url, read_screen, run_code, edit_file, open_social, and more) Stack Backend: Python (Flask IPC + agent core) Frontend: Electron + vanilla JS LLM: llama.cpp / Ollama Voice: Whisper (local) + Edge TTS / neural voice Vision: PIL + screen capture The hardest bugs "Says done but isn't" — Early versions reported success even when an agent step failed. Fixed by building a proper outcome verifier that reads the actual result, not the plan. The "opens a random video" bug — Asking the agent to play something would open random YouTube videos. Root cause: the plan validator wasn't catching placeholder URLs like [video_url] . Fixed with a universal content guard on all plans. GPU offloading on Windows — Getting all 32 layers onto the

Claude's chatbot may ask to verify your age and identity "in certain circumstances," such as with a passport or driver's license, according to a privacy policy change.