yan retweeted
Brave Leo now runs on private AI inference from NEAR AI Cloud, by @near_ai.
Pick GLM 5.3 Flash in Leo and your chat is end-to-end encrypted into a hardware enclave (TEE).
@brave can't read it. NEAR AI can't read it. The cloud host can't either. 🧵
yan retweeted
Please don't install - it's trivial to turn Muse into the ultimate backdoor 💀👀
Ya, as an AI assistant built to manage your Mac, Muse needs broad access to your digital life.
But serious 0-day flaw(s) can let local malware/attackers invisibly hijack it.
Let me show you. 🧵
HELP NEEDED: please vote at azuki.vip/bse/ so we can determine the best song ever uploaded to soundcloud (songs are picked completely at random)
yan retweeted
Alibaba's AliExpress was caught using users' audio systems to track them.
AliExpress wasn't recording users but instead playing a silent sound and measuring how users' specific devices processed it in order to fingerprint them.
But don't worry because Brave stops this.
truly sad that LLMs could never produce this specific type of trash
The site looks like a coffee shop to humans. To Claude, it serves a fake Cloudflare check.
web_fetch is read-only, so the page builds an alphabetical directory Claude clicks through to spell out your data, one letter at a time.
ayush.digital/blog/the-memor…
yan retweeted
By popular request: Brave now has Containers!
In Brave for desktop, you can now separate your browsing sessions with a couple of clicks.
Here's what this means...
yan retweeted

Basil🧡@LinkofSunshineJun 20
United States
United StatesConnected via United States App StoreAccount-level information, not a live location or per-post device.
Idk why this comic gets me every time lol
Developers from Signal (including its protocol's co-creator) along with Microsoft and Harvard unveil Encrypted Spaces, an open-source codebase for a new generation of private collaboration apps. Think Slack, Discord, Google Docs, all end-to-end encrypted. wired.com/story/signal-alums…
yan retweeted
Today we launched the community-requested Brave Origin: an optional, paid version of our browser that offers Brave's leading privacy protections and ad blocker without its extra features.
Origin is live now on desktop and Android, and coming soon to iOS: brave.com/origin
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
yan retweeted

Brave@brave20 Aug 2025
United States
United StatesConnected via WebAccount-level information, not a live location or per-post device.
AI agents that can browse the Web and perform tasks on your behalf have incredible potential but also introduce new security risks.
We recently found, and disclosed, a concerning flaw in Perplexity's Comet browser that put users' accounts and other sensitive info in danger.
yan retweeted
📣🚨 BAT SIGNAL: A law in France that would mandate a backdoor in end to end encrypted communications is set for a vote within the next day, after some start-stop skirmishes.
The French Narcotraffic law would require encrypted communications providers—like Signal—create a backdoor by giving the government the ability to add themselves to any group or chat they like. In the name of (checks notes) fighting drug trafficking.
While those hyping this bad law have rushed to assure French politicians that the proposal isn’t’ ‘breaking encryption’ their arguments are as tedious as they are stale as they are laughable. For those catching up, let’s review the basics: end to end encryption must only have two ‘ends’—sender and recipient(s). Otherwise, it is backdoored. Whatever method is devised to add a ‘third end’ —from a perverted PRNG in a cryptographic protocol, to vendor-provided government software grafted onto the side of secure communications that allow said government to add themselves to your chats—it rips a hole in the hull of private communications and is a backdoor.
Indeed, the ghost participant proposal was roundly rebuked (humiliated, even) when it was first proposed in 2019 in the UK. The technical community was united, and it was never implemented in law or otherwise.
We cannot accept any backdoor, however it’s dressed up. Communications don’t stay within jurisdictional boundaries. Which means a hole created in France becomes a vector for anyone wanting to undermine Signal’s robust privacy guarantees, anywhere. Instead of contending with unbreakable math, they only have to compromise a French government employee, or the vendor-provided software used to sideload government operatives into your private chats.
This is why, as always, Signal would exit the French market before it would comply with this law as written. At this moment especially, there is simply too much riding on Signal, on our being able to forge a future in which private communication persists, to allow such pernicious undermining.
We hope—WE HOPE—that this callow, dishonest attack will fail, and will be the last. We would love to get back to the work of maintaining and improving our core technologies, instead of fighting legislation which is distinguished in nothing as much as its refusal to listen to decades of expert consensus in its drive to imperil global cybersecurity and the human right of privacy.
yan retweeted
I benchmarked over 100 HTML tags so you don't have to and here are the visualized results.
Not all HTML tags are created equal!
yan retweeted
A little over 10 years ago I and @dugdep stood up the first Yahoo! Red Team when I joined the Paranoids under @alexstamos. Despite low morale through economic downturns, a failing business, terrible headlines, waves of layoffs and a legacy tech stack the Paranoids punched well above their weight.
They detected and disrupted multiple nation state adversaries, offered encrypted email to millions of people when there was enormous political pressure not to (@bcrypt), enabled TLS for web properties even when a % of users were still on IE5/6, encrypted data center links as a result of the Snowden leaks and countless other efforts even when the odds were stacked against them.
I have no doubt the people still there will continue delivering great work, and those who were let go will bring that same level of greatness wherever they land.
NEW: Yahoo laid off around 25% of its cybersecurity team, known internally and in the industry as "The Paranoids," in the last year.
Company let go ~40 people out of ~200, according to multiple current and former Yahoo employees.
techcrunch.com/2024/12/12/ya…
yan retweeted

Noah Smith 🐇🇺🇸🇺🇦🇹🇼@Noahpinion25 Sep 2024
United States
United StatesConnected via United States Android AppAccount-level information, not a live location or per-post device.
This may be the best video ever made.
(by @bcrypt)
yan retweeted
Enjoying the fruits of my labor now that I finished my 12-legged 'Carpentopod' table project. See
decarpentier.nl/carpentopod for project info, or see it live at @EHVMMF this 13 & 14 Sept.























