Security

via John Voorhees (@johnvoorhees@macstories.net): Hybrid compute for Perplexity’s Personal Computer is an exciting development that runs on Apple silicon Macs and blends cloud-based frontier models with local AI. Details on MacStories.

Perplexity’s new “hybrid compute” runs agent tasks in the cloud by default, but a local classifier flags potentially sensitive data and offers to route that portion to a model running on your Apple silicon Mac — and it works for sessions started from an iPhone or iPad, too. Data privacy is the next big blocker for agentic tools in regulated industries, so it’s good to see someone tackling it directly rather than asking customers to trust a cloud endpoint.

LocalSend is an open-source, cross-platform AirDrop alternative that moves files between Windows, macOS, Linux, Android, and iOS entirely over your local network. No accounts, no cloud, no trackers — just encrypted transfers at WiFi speed. (Found via a colleague at work.)

via Rust Weekly 🦀 (@rust_discussions@mastodon.social): Rust Won’t Save Us: An Analysis of 2023’s Known Exploited Vulnerabilities

Horizon3’s analysis of the 2023 CISA Known Exploited Vulnerabilities catalog finds that memory-safety bugs account for a relatively small share of what attackers actually exploit; injection flaws, authentication bypasses, and logic errors dominate. A useful reality check for those of us who reach for Rust as a security panacea — memory safety closes one door, but plenty of others remain wide open.

Prossimo’s benchmarking work on Rustls shows the Rust TLS implementation already beating OpenSSL 3.2 in several scenarios, with automated per-PR performance feedback to catch regressions. A nice demonstration that memory safety doesn’t have to come at the cost of performance — historically the main argument for staying with C.

via TidBITS (@TidBITS@mastodon.social): How to Turn Off Smart TV “Automatic Content Recognition”

Smart TVs use automatic content recognition (ACR) to screenshot everything you watch twice per second, sending data back for targeted advertising — regardless of whether content comes from cable, streaming, or a game console. The Markup provides instructions for turning ACR off on Roku, Samsung, and LG TVs, though it takes between 10 and 37 clicks depending on the platform.

Via Royce Williams on Mastodon: Missed this a couple of weeks ago from Consumer Reports: “How to Turn Off Smart TV Snooping Features”:

All smart TVs — from Samsung, LG, you name it — collect personal data. These TV privacy settings limit what manufacturers learn.

via Six Colors: Apple is destroying the Mac by trying to make it safer (Macworld/Jason Snell)

Interesting read on what one learns from auditing other company’s code for several years.

via Rust Weekly: Inside Rust Blog: crates.io Postmortem: User Uploaded Malware

via Stephen Shankland: I predict that passkeys will be a big deal. In my tests using them for Google login, then with CVS just prompting me to migrate to them from password authentication, they were indeed pretty simple to use. 1Password is testing the ability to store passkeys and now the ability to unlock your passkey vault with passkeys. My latest story:

via Micah Lee: You ever really want to open a sketchy document to see what’s in it, but you also don’t want to get hacked? Dangerzone is what you need. It takes potentially dangerous PDFs, office documents, or images and convert them to safe PDFs using sandboxes

via Cory Doctorow’s linkblog:

Two decades ago, my life changed forever: hearing #BruceSchneier explain that “#security” doesn’t exist in the abstract. You can only be secure from some threat. A fire alarm won’t protect you from burglaries. A condom won’t protect you from mass shootings. It seems obvious, but how often do we hear about “security” without any mention of who is being made secure, and from which threat?