As with many consumer protection laws, California is leading the way with regard to data privacy. In recent years, with the Delete Act and the DROP tool (Delete Request and Opt-out Platform), California residents have gained a lot more power over who can collect their personal data and even been given a simple, one-stop site for requesting deletion of all their data from third parties. And thanks to CA, we will all have the ability to globally request that websites not collect or share our personal data with a simple browser setting. I’ll be discussing these wonderful tools with the Executive Director of CalPrivacy, Tom Kemp, and how they can even help non-residents to claw back some control of their data on the web.

Interview Notes

• CalPrivacy: https://privacy.ca.gov/ 
• DROP tool: https://privacy.ca.gov/drop/ 
• Global Privacy Control: https://globalprivacycontrol.org/ 
• States honoring GPC: https://cookiechimp.com/blog/global-privacy-control-gpc 
• Enable GPC: https://firewallsdontstopdragons.com/how-to-enable-global-privacy-control/ 
• Data broker deletion: https://firewallsdontstopdragons.com/dragon-hacks-opt-out/ 
• PHP checker: https://github.com/PrivacySafe/security-patches 

Further Info

• My book: https://fdsd.me/book 
• My newsletter: https://fdsd.me/newsletter 
• Support the mission: https://fdsd.me/support 
• Give the gift of privacy and security: https://fdsd.me/coupons 
• Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

• 0:00:18: Intro
• 0:01:21: Interview setup
• 0:03:45: What’s it like bring on the inside?
• 0:10:37: Are companies complying or resisting?
• 0:14:41: Do states lead the way if feds can’t?
• 0:21:18: How does GPC work?
• 0:25:57: What states currently honor GPC?
• 0:32:27: What did we learn from Do Not Track?
• 0:35:03: How do we curb tracking in the real world?
• 0:39:45: How does DROP work?
• 0:46:39: Have these laws impacted the data broker industry?
• 0:51:03: Does transparency drive action?
• 0:55:44: So what can we do?
• 0:58:18: What’s next for CalPrivacy?
• 1:00:46: Wrap-up
• 1:03:48: Patron podcast preview
• 1:04:35: Looking ahead

In the past, we’ve been told that “there’s an app for that” – meaning, if you search the app store, surely you can find a pre-existing app that does what you’re looking for. But maybe it does a lot of stuff you don’t want, too. Maybe it’s chock full of ads or extracts your personal info. Maybe it just costs too much or requires a subscription. But you now have the power to create your own custom apps, without knowing a single thing about coding. I’ll explain how.

In the news: Microsoft fixes a record 1400+ bugs this month; US shuts down dozens of North Korean laptop farms; how to validate Amazon messages; Google starts linking all your accounts to your phone; European solar, wind farms vulnerable online; your car shares lots of your data; AI can pinpoint dwellings from a single internal photo; Amazon rolling out smart glasses to drivers; Google is saving your voice, video, photos from AI; OK judge rules ALPR searches require warrants; creator has vibe-coded replacements for Adobe, Microsoft suites.

Article Links

1. Microsoft Patches More Than 1,400 Security Flaws: https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws
2. U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud: https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html
3. PSA: How to check if that Amazon call, email, or text message is a scam: https://this.weekinsecurity.com/how-to-check-if-that-amazon-call-email-or-text-message-is-a-scam
4. PSA: Google is silently linking your phone number across all signed-in accounts: https://www.androidauthority.com/google-auto-phone-number-verification-android-3723117
5. Thousands of European wind and solar power systems exposed online: https://www.reuters.com/technology/thousands-european-wind-solar-power-systems-exposed-online-dutch-researchers-say-2026-10-06
6. Your Car Is Sharing Data With Big Tech Companies, Study Finds: https://www.consumerreports.org/electronics/personal-information/your-car-is-sharing-data-with-big-tech-companies-study-finds-a4474820962
7. AI Company Lets Cops Pinpoint Specific Houses Based on a Single Interior Photo: https://www.404media.co/ai-company-lets-cops-pinpoint-specific-houses-based-on-a-single-interior-photo
8. Amazon Drivers’ Smart Glasses Are Going to Be an Image Problem: https://www.bloomberg.com/opinion/articles/2026-09-30/amazon-drivers-smart-glasses-are-going-to-be-an-image-problem
9. Google Just Quietly Started Saving Your Photos and Voice: https://medium.com/@mohameddosou/google-just-quietly-started-saving-your-photos-and-voice-61eb37ced542
10. Oklahoma judge’s Flock ruling shows the power of Supreme Court’s digital evidence decision: https://therecord.media/oklahoma-flock-ruing-supreme-court-chatrie-decision
11. Creator of free Adobe clones unveils open-source Microsoft Office replications: https://www.tomshardware.com/software/microsoft-office/creator-of-free-adobe-clones-unveils-open-source-microsoft-office-excel-powerpoint-and-word-replications-autodesk-tools-and-other-subscription-based-services-may-come-next
12. Tip of the Week: https://firewallsdontstopdragons.com/build-your-own-apps-with-ai/ 

Further Info

• Google’s My Activity settings: https://myactivity.google.com/myactivity 
• ArtCraft apps: https://getartcraft.com/apps 
• My book: https://fdsd.me/book 
• My newsletter: https://fdsd.me/newsletter 
• Support our mission! https://fdsd.me/support 
• Give the gift of privacy and security: https://fdsd.me/coupons 
• Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

• 0:00:07: Intro
• 0:00:23: Book update
• 0:02:21: News rundown
• 0:04:38: Microsoft patches 1400+ bugs
• 0:07:05: FBI shuts down NK laptop farms
• 0:09:21: PSA: Amazon Message Center
• 0:11:30: Google linking all accounts to number
• 0:14:01: European solar, wind facilities found vulnerable
• 0:17:29: Cars collect and share lots of data
• 0:25:58: AI app IDs homes from interior pics
• 0:35:55: Amazon driver glasses and privacy
• 0:45:23: Google training on your media
• 0:53:43: Judge says ALPR searches require warrant
• 1:00:43: AI recreates MS Office, Adobe suite
• 1:07:28: Tip of the Week
• 1:16:43: Wrap-up
• 1:17:29: Patron podcast preview
• 1:17:50: Looking ahead

Residential proxy networks have become very popular ways for bad guys to launder their illicit activities through our normal home network traffic. By mixing in their traffic with ours, they are able to use (and abuse) the good reputation of our home IP address. Many of us have unwittingly allowed this to happen by using cheap streaming boxes or installing shady apps on our smart TVs. Today we’ll discuss residential proxies and botnets with Dan Goodin, Senior Security Editor at Ars Technica.

Interview Notes

• Dan Goodin: https://arstechnica.com/author/dan-goodin/ 
• Dan on router security: https://arstechnica.com/security/2026/07/the-us-government-warns-that-russia-state-hackers-are-coming-after-your-router/ 
• Brian Krebs story: https://krebsonsecurity.com/2026/06/popa-botnet-linked-to-publicly-traded-israeli-firm/ 
• Greynoise IP reputation: https://check.labs.greynoise.io/ 
• OpenWRT: https://openwrt.org/docs/start 
• Shields Up!: https://www.grc.com/shieldsup 

Further Info

• My book: https://fdsd.me/book 
• My newsletter: https://fdsd.me/newsletter 
• Support the mission: https://fdsd.me/support 
• Give the gift of privacy and security: https://fdsd.me/coupons 
• Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

• 0:00:16: Intro
• 0:02:03: Lingo
• 0:05:01: How did you get into security?
• 0:08:59: What is a residential proxy?
• 0:15:08: Who’s behind these proxy networks?
• 0:19:12: What is a botnet?
• 0:22:03: How are home devices compromised?
• 0:30:01: Can I be liable for proxied attacks?
• 0:33:00: How do you take down a botnet?
• 0:39:12: Should the gov’t unhack our devices?
• 0:43:03: Can we detect proxy devices?
• 0:47:43: Wrap-up
• 0:53:28: Patron podcast preview
• 0:53:47: Looking ahead

Meta has released a very powerful new AI agent app called Muse. Likewise, OpenAI has released a similar app called Dots. Both apps feature charming, friendly and decidedly non-threatening avatars to perhaps assuage your fears of AI. But these agents ask for extensive access to your data and devices, which in my view is – as for right now – too dangerous. We’ve already seen these agents doing things their owners were not expecting and did not want. I’ll tell those stories and give you my advice on using AI agents.

In other news: Android 17 adds welcome security features; weakness found in important encryption algorithm; update TeamViewer ASAP; some Samsung fridges bricked by SW update; CA closes data broker law loophole; USPS trialing cameras on vehicles; iPhone inactivity reboot thwarted? ; malware steals water utility credentials; US military and FBI employee records stolen; Amazon blocks Meta’s AI agent; Muse reads user’s Apple Messages;

Article Links

News Briefs

1. Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools. [thehackernews.com – The Hacker News]: https://thehackernews.com/2026/10/android-17-advanced-protection-locks.html
2. New Attack Against RSA – Schneier on Security. [schneier.com – Bruce Schneier – Sep 28, 2026]: https://www.schneier.com/blog/archives/2026/09/new-attack-against-rsa.html
3. TeamViewer urges users to patch severe flaws “as soon as possible”. [bleepingcomputer.com – Sergiu Gatlan]: https://www.bleepingcomputer.com/news/security/teamviewer-urges-users-to-patch-severe-flaws-as-soon-as-possible
4. Owners mourn spoiled food after firmware update bricks Samsung smart fridges. [arstechnica.com – Scharon Harding – Sep 23, 2026]: https://arstechnica.com/gadgets/2026/09/owners-mourn-spoiled-food-after-firmware-update-bricks-samsung-smart-fridges
5. California Expands Privacy Protections by Strengthening Deletion Rights. [privacy.ca.gov – nicolecameron – Sep 27, 2026]: https://privacy.ca.gov/2026/09/california-expands-privacy-protections-by-strengthening-deletion-rights
6. USPS To Put Cameras in Trucks That Scan Roads for ‘Community Safety’. [404media.co – Joseph Cox – Sep 30, 2026]: https://www.404media.co/usps-to-put-cameras-in-trucks-that-scan-roads-for-community-safety
7. Cops Can Bypass iPhone’s Automatic Reboot to Get Into Locked Phones, Leaked Video Claims. [404media.co – Lorenzo Franceschi-Bicchierai – Oct 1, 2026]: https://www.404media.co/cops-can-bypass-iphone-automatic-inactivity-reboot-graykey

Full Stories

1. Stolen passwords are exposing America’s water providers to hackers. [techcrunch.com – Zack Whittaker – Sep 22, 2026]: https://techcrunch.com/2026/09/22/stolen-passwords-are-exposing-americas-water-providers-to-hackers
2. Hackers stole millions of US military personnel records during months-long data breach. [techcrunch.com – Zack Whittaker – Sep 30, 2026]: https://techcrunch.com/2026/09/30/hackers-stole-millions-of-us-military-personnel-records-during-months-long-data-breach
3. ‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees. [404media.co – Joseph Cox – Sep 22, 2026]: https://www.404media.co/we-hacked-the-fbi-hackers-say-they-have-data-on-all-fbi-employees
4. Amazon Blocks Meta’s Muse AI Assistant. [daringfireball.net]: https://daringfireball.net/linked/2026/09/22/amazon-blocks-muse
5. Meta’s New Muse AI Agent Read My Private Messages. I Never Asked It To. [inc.com – Jason Aten – Sep 19, 2026]: https://www.inc.com/jason-aten/metas-new-muse-ai-agent-read-my-private-messages-i-never-asked-it-to/91408202 
6. Tip of the Week: https://firewallsdontstopdragons.com/hold-off-on-muse-dots/ 

Further Info

• My book: https://fdsd.me/book 
• My newsletter: https://fdsd.me/newsletter 
• Support our mission! https://fdsd.me/support 
• Give the gift of privacy and security: https://fdsd.me/coupons 
• Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

• 0:00:07: Intro
• 0:00:49: News rundown
• 0:02:43: New Android 17 security features
• 0:04:18: RSA encryption weakened?
• 0:06:52: Update TeamViewer now
• 0:07:44: Samsung fridges bricked
• 0:09:23: CA closes data loophole
• 0:11:10: USPS trialing cameras on vehicles
• 0:13:23: iPhone inactivity reboot thwarted?
• 0:15:22: Malware steals water utility creds
• 0:19:27: US military records stolen
• 0:22:19: Massive FBI data breach
• 0:31:01: Amazon blocks Meta’s Muse
• 0:37:30: Muse reads Apple Messages
• 0:46:13: Tip of the Week
• 0:53:04: Patron podcast preview
• 0:53:42: Looking ahead

Today marks an incredible milestone for this podcast: 500 episodes! Not only is that a crazy long run for any podcast, but I’ve also been astonishingly consistent. I’ve managed to put out an episode of this show every single week for 500 straight weeks! Okay… I did miss one week 8 years ago… I’ll give you that story in today’s podcast. But as always for my “podcentennial” episodes, my guest is the one and only global cybersecurity guru Bruce Schneier. He’s been on the show for every 100th podcast. Today I’ll ask Bruce some deep questions about artificial intelligence and how he sees it impacting our future – not just in the technical realm, but the political and social realms, as well. We also have some special surprises and bonus content for this momentous occasion!

Interview Notes

• Bruce Schneier: https://www.schneier.com/ 
• Bruce’s DEF CON 34 talk: https://www.youtube.com/watch?v=eEBv0STiYhI 
• Bruce’s books: https://www.schneier.com/books/ 
• Inrupt’s Solid Project: https://www.inrupt.com/solid 
• Apertus AI: https://www.apertus-ai.org/ 
• Cap’N Crunch whistle: https://www.thingiverse.com/thing:6192416 
• Citizenfour: https://www.imdb.com/title/tt4044364/ 
• Techlore: https://techlore.tech/ 
• The New Oil: https://thenewoil.org/en/ 
• Privacy Guides: https://www.privacyguides.org/ 
• Privacy Safe: https://privacysafe.social/ 
• Micah’s book: https://nostarch.com/hacks-leaks-and-revelations 
• UnDisruptable27: https://u27.org
• Yael’s blog: https://yaelwrites.com/ 
• Cult of the Dead Cow:  https://cultdeadcow.com/ 
• Bob Lord’s Hacklore: https://www.hacklore.org/ 
• David Ruiz: https://www.malwarebytes.com/blog/authors/davidruiz 
• Melanie Ensign’s Discernible: https://www.discernibleinc.com/ 

Further Info

• Help me celebrate this 500th show!!! : https://fdsd500.com 
• Pay it forward and help others : https://fdsd.me/phase2 
• Last chance to get #FDSD500 merch!! https://fdsd.me/merch 
• My book: https://fdsd.me/book 
• My newsletter: https://fdsd.me/newsletter 
• Support the mission: https://fdsd.me/support 

Table of Contents

• 0:00:00: Congratulations, part 1
• 0:01:47: Intro
• 0:07:12: Congratulations, part 2
• 0:10:31: Intro, continued
• 0:12:01: Stay tuned…
• 0:13:16: Interview setup
• 0:15:26: What are the key parts of a modern LLM?
• 0:23:03: How do we defend against prompt injection?
• 0:27:09: Should AI agents only act on our behalf?
• 0:32:10: Who’s responsible when AI attacks?
• 0:35:25: Will AIs end up fighting each other?
• 0:41:47: How will AI’s speed and scale change security?
• 0:46:50: Should we own our personal AI data?
• 0:55:03: Can we trust AI with all our data?
• 0:59:24: Does AI enhance mass surveillance?
• 1:03:09: How do we democratize AI?
• 1:06:24: What can we do to manifest the best AI future?
• 1:11:08: Wrap-up
• 1:11:42: Cap’n Crunch whistle
• 1:13:50: Thank you patrons!!!
• 1:16:27: FDSD by the numbers
• 1:23:25: Phase 1, 2 update
• 1:26:17: Phase 3?
• 1:26:55: Special bonus guest target
• 1:29:18: Patron podcast preview
• 1:30:40: Last call for FDSD500 merch
• 1:31:14: Looking ahead

In the last week, many news organizations have breathlessly covered the “AI doomer” comments by a former Anthropic employee, who said that many of his colleagues were secretly worried about AI ending all of humanity – and that it could happen in just a few years. But to me, there are more pressing concerns with AI and so far we’ve not responded in useful ways. I have several thoughts.

In the news: Android patches some severe bugs (update now); Google implements method to securely move passwords and passkeys; Radaris loses its domains in court fight; Boston dumps Flock cameras; Discord is going through with age verification; CISA is cutting programs that help secure critical infrastructure; hackers reveal Flock’s camera software; AI companies are reading chatbot session text; Apple debuts Apple Watch constant audio recording; and an interesting article on how to avoid the AI automation paradox.

Article Links

News Briefs

1. Google fixes actively exploited Android zero-day on Pixel devices: https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices
2. Google is making it easier to switch between password managers on Android: https://techcrunch.com/2026/09/10/google-is-making-it-easier-to-switch-between-password-managers-on-android
3. Data Broker Radaris Loses Domains in Privacy Fight – Krebs on Security: https://krebsonsecurity.com/2026/09/data-broker-radaris-loses-domains-in-privacy-fight
4. Boston dumps Flock, says it shared data nationwide in violation of contract: https://arstechnica.com/tech-policy/2026/09/boston-dumps-flock-says-it-shared-data-nationwide-in-violation-of-contract
5. Discord Is Bringing Back Age Verification for Millions of Users: https://www.gadgetreview.com/discord-is-bringing-back-age-verification-for-millions-of-users
6. CISA Cuts Critical Infrastructure Security Resources: https://www.securitymagazine.com/articles/102561-cisa-cuts-critical-infrastructure-security-resources

Full Stories

1. Hackers Stole Flock’s Camera Software, Revealing How the Company Tracks Cars and People: https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2
2. Inside ‘Project Lily’: The Humans Reading Your ChatGPT Chats: https://www.404media.co/inside-project-lily-the-humans-reading-your-chatgpt-chats
3. Watch what you say: Apple opens the door to a nightmare world of always-listening tech: https://this.weekinsecurity.com/watch-what-you-say-apple-opens-the-door-to-a-nightmare-world-of-always-listening-tech
4. The AI Researcher Who Just Quit Anthropic Says It’s ‘Crunch Time for Humanity’: https://www.wired.com/story/anthropic-researcher-quits-jacob-coxon-ai-fears-humanity
5. AI Efficiency Could Cost Us the Next Generation of Experts: https://spectrum.ieee.org/ai-engineer-skills
6. Tip of the Week: https://firewallsdontstopdragons.com/solving-the-ai-paradox/ 

Further Info

• Pay it forward and help others : https://fdsd.me/phase2 
• Countdown to FDSD500!! https://fdsd500.com 
• Get your FDSD500 merch!! https://fdsd.me/merch 
• My book: https://fdsd.me/book 
• My newsletter: https://fdsd.me/newsletter 
• Support our mission! https://fdsd.me/support 

Table of Contents

• 0:00:07: Intro
• 0:01:53: News rundown
• 0:04:07: Update your Android devices
• 0:04:34: Android adopts credential moving tech
• 0:06:06: Radaris loses key domains
• 0:07:13: Boston ends Flock contract
• 0:07:52: Discord brings back age verification
• 0:09:38: CISA cuts critical support
• 0:11:14: Hackers reveal Flock software
• 0:19:10: Humans reading LLM chats
• 0:27:09: New Apple watch recording feature
• 0:34:28: AI employee sounds alarm
• 0:39:22: Efficiency at what cost?
• 0:48:54: Tip of the Week
• 0:59:56: Wrapup
• 1:02:07: Patron podcast preview
• 1:02:38: Looking ahead

While we do have some state privacy laws in the US that require companies to allow you to opt out of data collection, these companies have devised clever ways to make these options very hard to find and/or very hard to choose in a clear and consistent manner. The Electronic Privacy Information Center (EPIC) has done a study on several such companies and the tricky ways they have obscured the mechanisms to assert your privacy rights. We’ll get all the details from one of the co-authors of this report, Caroline Kraczon.

Interview Notes

• EPIC: https://epic.org/ 
• Opt out dark patterns: https://epic.org/press-release-epic-releases-new-report-on-manipulative-design-patterns-in-opt-out-processes/ 
• Full report (PDF): https://epic.org/wp-content/uploads/2026/05/Good-Luck-Opting-Out-Manipulative-Design-Patterns-in-Opt-Out-Processes.pdf 
• How to enable Global Privacy Control: https://firewallsdontstopdragons.com/how-to-enable-global-privacy-control/ 
• Yael Graur’s BADBOOL list: https://github.com/yaelwrites/big-ass-data-broker-opt-out-list 
• EasyOptOuts: https://easyoptouts.com/ 
• My series on removing online data:  https://firewallsdontstopdragons.com/osint-reconnaissance/ 
• How to enable GPC: https://firewallsdontstopdragons.com/how-to-enable-global-privacy-control/ 

Further Info

• Phase 2 has begun!! : https://fdsd.me/phase2 
• Countdown to FDSD500!! https://fdsd500.com 
• Get your FDSD500 merch!! https://fdsd.me/merch 
• My book: https://fdsd.me/book 
• My newsletter: https://fdsd.me/newsletter 
• Support the mission: https://fdsd.me/support 

Table of Contents

• 0:00:13: Intro
• 0:01:05: Interview setup
• 0:02:32: What are dark patterns?
• 0:08:21: What dark patterns did you see?
• 0:16:01: How are state-based laws enforced on the open web?
• 0:18:03: Which companies did you study?
• 0:19:52: Which companies were worst?
• 0:23:16: How can data gathering be harmful?
• 0:27:29: How is the notice and concent model broken?
• 0:33:15: Does AI enable a whole new privacy risk?
• 0:35:38: What’s the response been to your report?
• 0:37:15: Why is publicly available data exempt?
• 0:42:02: How useful are “privacy checkup” tools?
• 0:45:13: How effective are privacy laws?
• 0:52:00: How can we reduce incentives to collect data?
• 0:54:18: What can we do?
• 0:59:09: Wrap-up
• 1:02:07: Patron podcast preview
• 1:02:47: Looking ahead

Probably the single most important device on your home network in terms of security is your Wi-Fi router. In most cases, it’s the only thing between all your networked devices and the Internet’s bad guys. It’s crucial that you’re using an updated (and update-able) device from a reputable maker. I’ll explain why it’s important and how to pick a good router.

In other news: Plex media server urges users to update their software immediately; Meta settles a lawsuit for $18B and promises changes for kids; 153M personal ID cards were stolen and are for sale; ChatGPT has a new plugin to read and manage your iMessages; study shows Windows apps tattling on users; researcher shows how secret ballots can be re-identified; US Senator asks NSA to publish info on how to choose and use a good VPN; Flock vigilantism and vandalism soars; researchers find blatant back doors in cheap Chinese routers.

Article Links

News Briefs

1. Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws: https://thehackernews.com/2026/09/plex-urges-immediate-updates-after.html
2. Meta to pay $18 billion in teen social media addiction settlement: https://proton.me/blog/meta-teen-addiction-settlement

Full Stories

1. Identity Verification Is Broken. The 153 Million Driver’s Licenses Now for Sale Are Proof: https://gizmodo.com/identity-verification-is-broken-the-153-million-drivers-licenses-now-for-sale-are-proof-2000806437
2. ChatGPT’s iMessage plugin opens a backdoor in Apple Messages: https://proton.me/blog/chatgpt-apple-messages
3. Hidden Tracking in Windows Apps: https://adguard.com/en/blog/how-desktop-apps-watch-you-research.html
4. An Algorithmic Failure Beneath the Secret Ballot: https://blog.citp.princeton.edu/2026/08/03/an-algorithmic-failure-beneath-the-secret-ballot
5. Confused about which VPN is right, US senator asks the NSA for guidance: https://arstechnica.com/security/2026/09/us-senator-calls-on-the-nsa-to-give-guidance-for-use-of-vpns
6. Vigilantism comes for Flock: https://this.weekinsecurity.com/vigilantism-comes-for-flock
7. Security researchers find surveillance implants in Chinese-made routers sold worldwide — three different backdoor-like implants hidden in firmware: https://www.tomshardware.com/tech-industry/cyber-security/security-researchers-find-surveillance-implants-in-chinese-made-routers-sold-worldwide-three-different-backdoor-like-implants-hidden-in-firmware

Further Info

• Phase 2 is under way! : https://fdsd.me/phase2 
• Countdown to FDSD500!! https://fdsd500.com 
• Get your FDSD500 merch!! https://fdsd.me/merch 
• Jellyfin media server: https://jellyfin.org/ 
• Tailscale: https://tailscale.com/ 
• Proton blog: https://proton.me/blog 
• My book: https://fdsd.me/book 
• My newsletter: https://fdsd.me/newsletter 
• Support our mission! https://fdsd.me/support 

Table of Contents

• 0:00:07: Intro
• 0:02:26: 6th Edition update
• 0:04:15: News rundown
• 0:06:17: Plex media server critical fixes
• 0:08:47: Meta’s $18B lawsuit loss
• 0:10:40: 153M ID’s for sale
• 0:19:11: ChatGPT plugin for iMessage
• 0:27:28: Windows app tracking
• 0:38:23: Using AI to reveal your voting
• 0:48:42: Senator requests NSA VPN guidance
• 0:53:20: Rise in Flock vandalism
• 1:01:17: Chinese routers with built-in backdoors
• 1:09:48: Tip of the Week
• 1:19:21: Phase 2 reminder
• 1:20:14: Patron podcast preview
• 1:20:34: Looking ahead

Software apps today are a hodgepodge of libraries, software development kits, and third party code, all stitched together like Frankenstein’s monster. Furthermore, software developers use common tools to create and deploy this software. The bad guys have figured out that by compromising one of these third party components or the tools used to create the products, they can instantly infect hundreds or thousands of products that all share the same underlying resources. This is a supply chain attack. Today we’ll discuss these single points of failure, how to identify them ahead of time and try to prevent these sorts of attacks with Cassie Crossley, CEO and co-founder of VulNow.

Interview Notes

• Cassie Crossley: https://www.linkedin.com/in/cassiecrossley/ 
• VulNow company website: https://vul.now/
• VulNow’s Pre-CVE database: https://precve.vulnow.com/ 
• CyBeats company website: https://www.cybeats.com/
• Software Supply Chain Security (book): https://www.oreilly.com/library/view/software-supply-chain/9781098133696/ 
• Proton blog on supply chain security: https://proton.me/business/blog/supply-chain-attack 
• Malus AI re-write tool: https://www.404media.co/this-ai-tool-rips-off-open-source-software-without-violating-copyright/ 
• xkcd on Dependency: https://xkcd.com/2347/ 
• Updated dependency diagram: https://www.grc.com/SN/1078.jpg 

Further Info

• Phase 2 has begun!! : https://fdsd.me/phase2 
• Countdown to FDSD500!! https://fdsd500.com 
• Get your FDSD500 merch!! https://fdsd.me/merch 
• My book: https://fdsd.me/book 
• My newsletter: https://fdsd.me/newsletter 
• Support the mission: https://fdsd.me/support 
• Give the gift of privacy and security: https://fdsd.me/coupons 
• Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

• 0:00:14: Intro
• 0:00:35: Phase 2 reminder
• 0:01:52: Interview setup
• 0:06:05: What is VulNow?
• 0:08:34: What software is vulnerable to supply chain attacks?
• 0:13:16: Have you heard of AI clean room coding?
• 0:15:34: How do SW supply chain attacks work?
• 0:21:21: How do we identify the weak points?
• 0:34:24: What are SBOM’s and how do they work?
• 0:43:45: What is needed beyond SBOMs?
• 0:50:32: Can tools reveal the contents of SW?
• 0:56:13: How do we encourage SBOM creation?
• 1:01:35: As consumers, how do we know who to trust?
• 1:06:09: What’s next for you?
• 1:08:46: Wrap-up
• 1:13:23: Patron podcast preview
• 1:14:19: Looking ahead

As part of my celebration of the upcoming 500th podcast, I’m launching Phase 2 of my “cyber neighbor” campaign to both help as many people be more secure and private as possible, but to also learn from this experience so I can improve these campaigns in the future. In particular, as I write the 6th edition of my book, I’m funneling this feedback into improving those Tips, as well.

In the news: Flock considered utilizing ride share and delivery vehicles to expand their ALPR network; judge rules ‘tower dump’ warrants unconstitutional; BMW’s show Spider-Man ads; hackers reuse expired domains for scams and malware; US warns of more PLC attacks; US proposal would allow private companies to launch cyber attacks on foreign groups; terabytes of credentials stolen in supply chain attack; customer downloads his 515-page McDonald’s dossier; AI agent hacks gym site to book a class; town claims Flock reactivated cameras without notice; and Chrome trials new device-bound session credentials.

Article Links

News Briefs

1. Flock wanted to put license plate cameras on 350,000 Uber and Lyft dashcams: https://www.techspot.com/news/113407-flock-wanted-put-license-plate-cameras-350000-uber.html
2. ‘Tower dump’ warrants ruled unconstitutional: https://thehill.com/regulation/court-battles/6013559-mississippi-judge-declares-towers-dumps-unconstitutional
3. BMWs are showing a commercial at startup: https://boingboing.net/2026/08/06/bmws-are-showing-a-spider-man-movie-ad-at-startup.html
4. Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware: https://thehackernews.com/2026/08/hackers-spend-nearly-7-million-on.html

Full Stories

1. US warns of AI-powered attacks on Siemens PLCs in critical infrastructure: https://www.bleepingcomputer.com/news/security/us-warns-of-ai-powered-attacks-on-siemens-plcs-in-critical-infrastructure
2. In a first, US will allow some private firms to carry out cyberattacks: https://techcrunch.com/2026/08/13/in-a-first-us-will-allow-some-private-firms-to-carry-out-cyberattacks
3. Terabytes of credentials leaked in massive supply-chain attack: https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack
4. McDonald’s Built a 515-Page Dossier on Me. It Says I’ll Never Stop Eating There: https://www.wired.com/story/mcdonalds-built-a-515-page-dossier-on-me-it-says-ill-never-leave
5. Told to book a gym class, an AI agent hacked the site instead to move its user up the waitlist: https://the-decoder.com/told-to-book-a-gym-class-an-ai-agent-hacked-the-site-instead-to-move-its-user-up-the-waitlist
6. Littleton claims Flock reactivated its cameras without notifying the town: https://www.lowellsun.com/2026/07/31/littleton-claims-flock-reactivated-its-cameras-without-notifying-the-town
7. Chrome adopts what may be the best protection yet against account takeovers: https://arstechnica.com/security/2026/08/chrome-adopts-what-may-be-the-best-protection-yet-against-account-takeovers
8. Tip of the Week: https://firewallsdontstopdragons.com/digital-citizen-phase-2/ 

Further Info

• Phase 2: https://fdsd.me/phase2 
• Countdown to FDSD500!! https://fdsd500.com 
• Get your FDSD500 merch!! https://fdsd.me/merch 
• NoALPRs: https://noalprs.com/ 
• FlockYou project: https://github.com/colonelpanichacks/flock-you 
• My book: https://fdsd.me/book 
• My newsletter: https://fdsd.me/newsletter 
• Support our mission! https://fdsd.me/support 

Table of Contents

• 0:00:07: Intro
• 0:00:26: Public service announcements
• 0:03:20: News rundown
• 0:05:25: Flock in Uber, Lyft, delivery vehicles
• 0:07:13: Tower dump warrants ruled unconstitutional
• 0:08:33: Some BMW’s show Spider-Man ad
• 0:10:49: Hackers use expired domains for scams
• 0:13:24: US warns of AI attacked on PLCs
• 0:18:05: US authorizes private cyber attacks
• 0:24:53: Terabytes of credentials leaked in supply chain attack
• 0:32:13: McDonald’s customer dossier
• 0:39:44: AI agent hacks gym site
• 0:45:22: Town claims Flock reactivated its cameras
• 0:49:39: Google trialing device-bound session cookies
• 0:57:00: Tip of the Week
• 1:04:31: Wrap-up
• 1:05:22: Patron podcast preview
• 1:05:45: Looking ahead

It's August, which means it's time for Hacker Summer Camp once again! I flew out to a sweltering Las Vegas, Nevada, to attend two of the three major cybersecurity ("hacker") conferences: BSides and DEF CON. I had an amazing week, spending time with new and old friends, meeting some of the people I've interviewed in person, lining up more podcast guests, and having wonderfully stimulating conversations with very smart people. While at DEF CON, I managed to record four mini interviews with Bob Lord, Naomi Brockwell, Josh Corman and the Dark Tangent himself, Jeff Moss. I will try to give you some idea what these conferences are like as we discuss several important and timely topics. Interview Notes Hacklore: https://www.hacklore.org/  Naomi Brockwell (NBTV): https://www.nbtv.media/  Ludlow Institute: https://www.ludlowinstitute.org/  Surveillance Accountability Act: https://www.surveillanceaccountability.com/  UnDisruptable27: https://u27.org  I Am the Cavalry, BSides 2026 (Monday): https://www.youtube.com/watch?v=r4C8stKbxBM  BSides IATC schedule: https://bsideslv.org/schedule#IATC  Cliff Stoll talk: https://www.youtube.com/live/_uYQr8hfpbI?t=13292s  DEF CON: https://defcon.org/ DEF CON 20 Documentary: https://archive.org/details/DEFCON20Documentary  DEF CON 33 Documentary: https://www.youtube.com/watch?v=pb0kJXSy64E  Further Info Digital Citizen, Phase 1: https://fdsd.me/phase1  Countdown to FDSD500!! https://fdsd500.com  Get your FDSD500 merch!! https://fdsd.me/merch  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Table of Contents 0:00:07: Intro 0:00:50: Hacker Summer Camp 0:11:30: Interview preface 0:14:26: Bob Lord 0:21:18: Bob afterword 0:24:08: Naomi intro 0:26:09: Naomi Brockwell 0:35:51: Naomi afterword 0:40:58: Josh intro 0:42:58: Josh Corman 0:56:01: Josh afterword 1:01:08: Jeff intro 1:03:00: Jeff Moss 1:23:12: Jeff afterword 1:24:30: Wrap-up 1:26:20: Patron podcast preview 1:26:45: Phase 1 still going 1:27:13: Looking ahead