We're about to enter a period where not reading or writing becomes as ubiquitous as smoking once was. We can hope people will eventually realize this is bad for them, as they did with smoking. But this is far from certain; the cost may not be as obvious.

X ALGORITHM UPDATE 🚨 X just stopped cutting new posts first, and that should help small accounts (I check it daily with Claude and share updates worth sharing with you) tl;dr: - X can only check 2,800 posts each time you open your feed - new posts used to be last in line, so they got cut first - now everything gets cut equally, new posts included - posts labeled low quality or misinfo now show a warning, and people can't like, reply or share them - no score changes this time lesson learned: your new posts now get a fair chance to be seen. Your first 2 hours still matter most. full details: - How it worked until this week Every time someone opens For You, X collects around 3,700 posts it could show them: posts from people they follow, popular posts, posts liked by similar people, and brand new posts. But X only has time to check 2,800 of them. So it just took the first 2,800 in line. Brand new posts were at the back of the line. When there were too many, they were the ones left out... and a post that never gets checked can't be shown. - What changed Now everything gets cut by the same amount. 25% too many? Every type of post loses 25%, new posts included. Nobody goes first. - Why small accounts should care Those brand new posts are under 2 hours old, with under 8 likes and under 500 views. That's where most posts from smaller accounts are. My read: they now get a fair chance instead of being cut first. How often X actually hits the 2,800 limit isn't in the code, so I can't tell you how big the difference is. - Low quality and misinfo posts now show a warning If X labels your post as low quality or misinformation, people who don't follow you see a warning on it, and they can't like, reply, repost, bookmark or share it. The code doesn't say what gets a post that label. Here's a recap of what you should be doing: - a new post gets its extra push only in its first 2 hours and first 200 views, so post when your people are online - likes carry more weight than ever at 0.66 each - people sticking around pays, the time-spent score is 50% higher than two weeks ago - a read of 10+ seconds after someone opens your post adds 0.4 - the boost favors the post with the best like rate from its first viewers - accounts up to 50K can get one fresh original lifted to roughly 16th - nothing beats a copy link share, it scores 20 - replies, quotes and DM shares each score 5 - talk with your mutuals, replies between you score 20 instead of 5 - originals are the only posts that travel outside your follower base - the 1st and the 32nd like each open a new route to strangers - your 2nd post in the same feed is worth 62% of the first, so pick your best one - videos still need 10+ seconds to qualify for the video lists - earning a follow adds 4 - a pinned post with a bad link can flag the account for 7 days, worth a quick check What you should NOT be doing: - posts that get labeled low quality or misinfo now carry a warning, and nobody outside your followers can like or share them - video alone won't carry you, an open counts 0.02 and the watch 0 - hide-worthy posts cost more, "not interested" sits at -52.27 - a post at 3am burns its 2 hour window before anyone sees it - a tap that turns into a bounce is worth only 0.3 - replies and reposts don't get past your followers - insults get your post hidden from anyone who doesn't follow you - adult media in 3 of your last 5 posts puts a label on your account - disguised content in videos gets checked from 64 likes, harder at 512 - self-reply chains under big accounts risk being zeroed - one account label and non-followers stop seeing you entirely - low-rated links don't belong in your pinned post - recycled wording can get tagged as copypasta spam - strangers tagged plus a low quality link is a pattern X flags - engagement bait has no size exemption - several posts in a row end up competing with each other - hashtag stacks add nothing - bookmarks are still worth 0 - 48 hours in, For You is finished with a post

If you've ever wondered why smart TVs are so cheap, this is why. @log4j rooted his Samsung and found an always-on hot mic, automatic content recognition, geolocation, network mapping, ad targeting and user profiling, shared with Samsung's "400 partners". A lot of it can be blocked in <15 min, wrote a basic guide below. What your TV is doing The main culprit is ACR (automatic content recognition). Your TV screenshots what's on screen, fingerprints it, and sends it home to build your ad profile. Samsung does it every 500ms, LG every 10ms [1]. What is insane: it happens on connected devices too. Plug in your laptop, your console, your work machine, and your TV can fingerprint that via HDMI [1]. He also found that if your Samsung doesn't have a mic, it'll look for one from a connected soundbar or bluetooth device. xitter.cf/log4j/status/211376224… It's on by default, and you likely agreed to it on the setup screen you clicked through in 10 seconds. Step 1: Turn off ACR Samsung: Terms & Privacy → Viewing Information Services LG: Live Plus Vizio: Viewing Data Roku: "Use info from TV inputs" Sony/Google TV: Samba Interactive TV Menus vary by model, but those are the names to look for. While you're in there, opt out of interest-based ads, reset your advertising ID, decline every optional privacy agreement, turn off voice recognition, and delete apps you never open. Step 2: Give smart devices their own network Put the TV, cameras, speakers and vacuum on your router's guest/IoT network. The logic is simple: these devices rarely get patched. If one gets compromised (getting drastically more frequent with AI), it shouldn't be able to see your other devices or home network. Step 3: Block trackers for the whole house with DNS-level filtering NextDNS (cloud-based) is easy and has a solid free plan. Pi-hole is a little bit more work if you prefer self hosting. For simplicity we'll focus on the former. 1. Sign up at nextdns.io (free tier is plenty) 2. Privacy tab: add a blocklist (OISD is a good bet) and turn on Native Tracking Protection for Samsung, LG, Roku, Amazon (see attached image) 3. Setup tab: copy your endpoint 4. Paste it into your router's DNS settings as DNS-over-HTTPS/TLS (or use the IPs + "Link IP" if your router only does plain DNS) 5. Bonus: block outbound port 53 except to your router. Some devices hardcode their own DNS to get around you Then open the NextDNS logs and watch how often your TV phones home. It's eye-opening. If an app or update breaks, find the domain in the logs and allowlist it. Why they do this TV prices are down 97% since 2000 [2]. Most of that is better manufacturing and brutal competition. But once margins on the hardware hit zero, the cost moved to you. In Q3 2024, Vizio lost $6.7M selling TVs and made $115.8M in gross profit from ads and viewing data [3]. They've said on earnings calls that they keep TV prices low to grow the audience they sell to advertisers. Walmart bought them in 2024. This isn't a conspiracy theory either. Vizio paid $2.2M to the FTC in 2017 for tracking 11 million TVs without consent. Last December, Texas sued Samsung, LG, Sony, Hisense and TCL over ACR. Samsung and LG have since agreed to stop collecting that data without explicit consent [4]. TL;DR 1. ACR off 2. Ads + voice off 3. Smart devices on their own network 4. NextDNS filtering on the router Sources: [1] ACR study: arxiv.org/abs/2409.06203 [2] Cost of US consumer goods: aei.org/economics/chart-of-t… [3] Vizio Q3 2024: sec.gov/Archives/edgar/data/… [4] Texas v. Samsung: texasattorneygeneral.gov/new…

Everyone who owns hardware with abominable software (like Sonos players) owes a debt of gratitude to Venkatraman Srinivasan and the rest of the eMudhra gang in Bengaluru, Karnataka. Without their gross negligence, it'd be a lot harder to counterfeit certificates and fix the sw🙏

Wild times grok.com/share/bGVnYWN5_caa3…

there is no moat

We’re adding long press on like to send someone $1 via 𝕏 Money

If an attacker parks outside your building with a $1,500 software-defined radio, a 5G smartphone will still drop its connection, connect to a fake 1991-era GSM tower, and hand over its permanent hardware identity in cleartext. Every modern baseband modem still carries legacy 2G silicon for backward compatibility, and that 2G stack has no way to verify if a cell tower is real. 1. The architectural flaw: One-way tower trust In 4G (LTE) and 5G, mobile networks enforce mutual authentication after the initial attach. When your phone connects to an LTE tower, the network sends a random cryptographic challenge (RAND) alongside an Authentication Token (AUTN). Inside your SIM card, a secure processor checks that token against a 128-bit secret root key (K) burned in at the factory. If the tower cannot prove it shares that key with your carrier, the baseband drops the connection before any voice or text data flows. In 2G (GSM), that check only runs in one direction. When GSM was standardized in 1991, commercial software-defined radios did not exist. The protocol was built so the tower authenticates the SIM card to stop billing fraud, while the SIM card never authenticates the tower. A 2G baseband processor will connect to any transmitter broadcasting a valid Mobile Country Code and a stronger signal (RXLev) than the surrounding towers. 2. How rogue base stations force the downgrade Because a rogue tower cannot forge a 4G cryptographic signature, it forces the phone's baseband to abandon 4G and 5G entirely. An attacker using an Ettus USRP B210 and a 10-watt RF power amplifier triggers this fallback in two ways: * Selective RF jamming: The radio floods local 4G and 5G downlink frequencies with noise while leaving a 2G GSM frequency clean. When the phone loses its LTE signal, the baseband's cell reselection state machine scans all supported bands and locks onto the attacker's clean 2G beacon. * Protocol downgrade injection: The attacker broadcasts a rogue LTE signal just long enough to catch the phone's tracking area update, then replies with an unauthenticated Tracking Area Update Reject (EMM Cause #7: EPS services not allowed) or an RRCConnectionRelease redirecting the modem straight to a 2G frequency. The baseband assumes you walked into a dead zone and switches to 2G in about 10 seconds without prompting the user. 3. Identity theft, A5/0, and the SMS relay catch Once the phone camps on the rogue 2G station, the attacker sends a standard Identity Request packet. The phone replies in cleartext with its 15-digit International Mobile Subscriber Identity (IMSI) and its hardware IMEI. Next comes encryption. Normal 2G traffic uses the 64-bit A5/1 stream cipher, which can already be cracked in seconds using 2TB Kraken rainbow tables. Worse, the 3GPP specification (TS 44.018) requires every phone to obey a Ciphering Mode Command set to A5/0 (null cipher). When the rogue tower sends A5/0, the phone turns off air-interface encryption completely. Any outgoing SMS or call from the victim's phone travels to the attacker's laptop as unencrypted GSM 7-bit bytes. To intercept incoming two-factor SMS codes from a bank, the attacker has to go one step further. Because a rogue SDR in a car is not wired into your real carrier's core network, the bank's SMS won't route to the attacker's laptop automatically. Either the attacker uses a second radio to relay your phone's handshake back to the real carrier's 2G tower and cracks the A5/1 downlink key, or they simply jam 4G so your phone drops onto the real carrier's 2G tower and passively crack the A5/1 air traffic in Wireshark. 4. The modern defense: Cutting legacy silicon You cannot patch a 1991 radio handshake without breaking backward compatibility, so OS vendors finally gave users a kill switch for the baseband: * Android 12+ 2G kill switch: Android added the setAllowedNetworkTypesForReason API to the Radio Interface Layer (RIL). Turning off "Allow 2G" instructs the modem firmware to disable its GSM stack at the silicon level. If 4G is jammed, the phone stays in "No Service" instead of dropping to 2G. * Android 14 & 15 null-cipher locks: Android 14 added a modem toggle to reject A5/0 null-cipher connections outright on supported hardware, and Android 15 added live system alerts whenever a tower requests an unencrypted connection or cleartext IMSI. * iOS Lockdown Mode: Turning on Lockdown Mode disables the 2G baseband stack on iPhones. * 5G Standalone (5G SA) SUCI: Even on 4G LTE, a phone still sends its IMSI in cleartext during the very first attach request before encryption starts. Pure 5G Standalone fixes this last gap: the SIM card uses ECIES public-key cryptography to encrypt your IMSI into a Subscription Concealed Identifier (SUCI) before a single packet leaves the antenna.

did you know your samsung tv has a service called rmdemon (that's not a typo, demon not daemon) that starts a PACKET LOGGER on your network. what possible legitimate use case could there be here, samsung?

The phone that becomes a robot…

"We can fix everything." This has become one of the mottos of @Omarchy, and it represents a fundamental shift in how we think about our operating systems. On Windows and macOS, we're used to countless papercuts, annoying bugs, and downright idiotic design decisions. Most of the time, there's nothing we can do about them. We find workarounds and eventually learn to live with the frustration. Omarchy changes that. If something annoys you, FIX IT! Your OS should adapt to you, not the other way around. And thanks to AI coding agents, you don't even need to be an experienced developer anymore. Anyone can make these changes. Once you get used to fixing things instead of putting up with them, it's hard to go back.

PREDICTION: Cloudflare CEO Matthew Prince (@eastdakota) says AI agents will change the business model of the Internet over the next decade: "In five years, agent traffic is going to be 1000x human traffic." "The Internet almost collapsed during COVID when traffic doubled." "There's a lot more servers, routers, and bandwidth that has to get provisioned in order for that to work. The question is, who will pay for it?" "My hunch is that something's got to change in terms of how the Internet works. Like some version of micropayments that every time you access a resource, your agent pays a ten-thousandth of a penny to be able to see the menu." "Then there's probably some sort of trade where if you are willing to tell the restaurant what you're looking for, that price goes down, maybe it's free. In some cases, the site might actually pay you to come visit it." "This will lead to the next version of advertising, which is how do you advertise to agents?"

HeartPrint is live. 💛 Our phones are full of photos, videos and messages, and the stories behind them mostly get lost. HeartPrint helps you keep them. The Story of You. 🧵