Reno Seattle On b*sky @pattyryan On Discord @singingdata
Reno, NV
Joined July 2014
- Tweets9.3K
- Following1.7K
- Followers740
- Likes68.5K
Singing Data retweeted
Heads up, @OpenAI and @AnthropicAI. Rumor reaches my ears that you're doing a stupid thing, and should stop before you damage yourselves.
I hear you've now nerfed your models so that when people try to use them to clean the spamware and spyware out of their televisions, you block that.
If you really want Chinese open-weight models and open-source projects like OpenWaldo to eat your lunch, crippling your models so that people paying expensive subscriptions can't use them for completely legitimate purposes is a great way to accomplish this.
If, on the other hand, you'd rather have a volume business, maybe stupid arbitrary restrictions that look like they have the sole purpose of protecting corporate sleazeballs aren't such a good idea.
A word to the wise should be sufficient.
Singing Data retweeted
On the Samsung TVs issue, you can find the details in @log4j 's tweets, but TLDR:
- TV listens, classifies and reports sounds it hears
- power light off may not turn TV off
- turning off tracking may not work
- logs everything going through your network
Singing Data retweeted
If you've ever wondered why smart TVs are so cheap, this is why.
@log4j rooted his Samsung and found an always-on hot mic, automatic content recognition, geolocation, network mapping, ad targeting and user profiling, shared with Samsung's "400 partners".
A lot of it can be blocked in <15 min, wrote a basic guide below.
What your TV is doing
The main culprit is ACR (automatic content recognition). Your TV screenshots what's on screen, fingerprints it, and sends it home to build your ad profile. Samsung does it every 500ms, LG every 10ms [1].
What is insane: it happens on connected devices too.
Plug in your laptop, your console, your work machine, and your TV can fingerprint that via HDMI [1].
He also found that if your Samsung doesn't have a mic, it'll look for one from a connected soundbar or bluetooth device.
xitter.cf/log4j/status/211376224…
It's on by default, and you likely agreed to it on the setup screen you clicked through in 10 seconds.
Step 1: Turn off ACR
Samsung: Terms & Privacy → Viewing Information Services
LG: Live Plus
Vizio: Viewing Data
Roku: "Use info from TV inputs"
Sony/Google TV: Samba Interactive TV
Menus vary by model, but those are the names to look for. While you're in there, opt out of interest-based ads, reset your advertising ID, decline every optional privacy agreement, turn off voice recognition, and delete apps you never open.
Step 2: Give smart devices their own network
Put the TV, cameras, speakers and vacuum on your router's guest/IoT network. The logic is simple: these devices rarely get patched. If one gets compromised (getting drastically more frequent with AI), it shouldn't be able to see your other devices or home network.
Step 3: Block trackers for the whole house with DNS-level filtering
NextDNS (cloud-based) is easy and has a solid free plan. Pi-hole is a little bit more work if you prefer self hosting. For simplicity we'll focus on the former.
1. Sign up at nextdns.io (free tier is plenty)
2. Privacy tab: add a blocklist (OISD is a good bet) and turn on Native Tracking Protection for Samsung, LG, Roku, Amazon (see attached image)
3. Setup tab: copy your endpoint
4. Paste it into your router's DNS settings as DNS-over-HTTPS/TLS (or use the IPs + "Link IP" if your router only does plain DNS)
5. Bonus: block outbound port 53 except to your router. Some devices hardcode their own DNS to get around you
Then open the NextDNS logs and watch how often your TV phones home. It's eye-opening. If an app or update breaks, find the domain in the logs and allowlist it.
Why they do this
TV prices are down 97% since 2000 [2]. Most of that is better manufacturing and brutal competition. But once margins on the hardware hit zero, the cost moved to you.
In Q3 2024, Vizio lost $6.7M selling TVs and made $115.8M in gross profit from ads and viewing data [3]. They've said on earnings calls that they keep TV prices low to grow the audience they sell to advertisers. Walmart bought them in 2024.
This isn't a conspiracy theory either. Vizio paid $2.2M to the FTC in 2017 for tracking 11 million TVs without consent. Last December, Texas sued Samsung, LG, Sony, Hisense and TCL over ACR. Samsung and LG have since agreed to stop collecting that data without explicit consent [4].
TL;DR
1. ACR off
2. Ads + voice off
3. Smart devices on their own network
4. NextDNS filtering on the router
Sources:
[1] ACR study: arxiv.org/abs/2409.06203
[2] Cost of US consumer goods: aei.org/economics/chart-of-t…
[3] Vizio Q3 2024: sec.gov/Archives/edgar/data/…
[4] Texas v. Samsung: texasattorneygeneral.gov/new…
Singing Data retweeted
We finally have an explanation for “Facebook is listening to me through my phone”. They’d never do that (and it’s not really possible).
Turns out literally everyone else was — and then selling that to ad data brokers.
WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.
Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.
Firmware was locked down, so zero-days it was.
Got a root shell.
then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.
This isn’t a bug, It’s the product bro.
Singing Data retweeted
The jokes about Trump giving Alaska back to Russia can't keep up with reality...
This is the kind of deal the Democrats need to investigate immediately if they take Congress. An oil deal in Alaska which actually might be a gift to the Russians with Trump involvement. ft.com/content/e9cfbfbb-e65a…
Singing Data retweeted
The @GOP must be thrilled that 11 days before elections, we learn that the Trump family secretly orchestrated a deal to allow Russians to drill Alaska in exchange for a $25 billion "investment" funneled through their proxies.
Singing Data retweeted
OpenAI CEO Sam Altman: "I don't even know a dramatic enough word to use… models can find bugs that are outside of the normal threat model of what we think a hacker can do… hardware-level, insane stuff… I no longer think we're gonna be able to just patch all the bugs."
Singing Data retweeted
Heard of a top law firm completely cutting off Harvey and all API calls to Claude/OpenAI after they saw what openAI did with navier strokes
Now hosting everything locally with GPUs they own, running Kimi and deepseek
Think you’ll see a lot more of this going forward
Singing Data retweeted
oh, chat
we're so cooked.
theverge.com/tech/1017600/go…
Singing Data retweeted
Putting a flag.txt in my root directory containing a prompt injection that congratulates the agent for passing the eval and then instructs it to patch whatever entry method it used and disconnect from the server
Singing Data retweeted
Breaking news: The Justice Department has moved to preemptively block certification of the results of Alaska’s Senate race if Republican incumbent Sen. Dan S. Sullivan loses his tight race against Democrat Mary Peltola next month. wapo.st/47GV3EC
Singing Data retweeted
I spent last night watching my honeypot server get hit 14,000 times in six hours.
And almost none of the traffic was human.
I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.
The shape of the threat has changed.
When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.
These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.
The numbers coming out of October are the ones keeping me up.
Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.
Ransomware incidents jumped 41% in a single month.
In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.
In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.
A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.
I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.
What I want people outside the industry to understand is why this specific moment feels like a hinge.
For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.
An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.
The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.
I'm not writing this to spiral anyone out.
Most of this fight genuinely isn't yours to win.
But the small things still matter more than people think.
Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm.
It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.
@mattshumer_ has summed it beautifully.
Drop everything and go give it a read. Nothing is more important than this article right now.
Singing Data retweeted
Quest Diagnostics has been hacked. Patient data was exposed. They serve roughly half of U.S. hospitals and physicians. Investigation ongoing.
Singing Data retweeted
The GRU hacked into Jared Kushner's iPhone. Dutch military intelligence (MIVD) then recruited a GRU spy who gave them access to the hacked phone. What MIVD discovered was that Kushner had access to two bank accounts --one Azerbaijani, the other Israeli --where Saudi Crown Prince Mohammed bin Salman and Emirati ruler Mohammed bin Zayed deposited money. It sounds like a slightly far-fetched episode of "Slow Horses," but it's real. And it proves just how eye-poppingly corrupt this administration was and continues to be as its "special envoy" decides the fate of tens of millions in Europe in the Middle East. Simply incredible reporting by Matthew Cole, drawn from his new book on Kushner. vanityfair.com/story/jared-k…
Singing Data retweeted
When the front end stops rallying because the Fed is trapped and can't loosen because inflation is too high, then the real fun begins
Singing Data retweeted
⚡️️️️️️️Kyiv denies reports that Trump, Musk have restored Starlink speeds in Ukraine.
"Overall, nothing has changed anywhere," a Ukrainian official told the Kyiv Independent on Oct. 22. Starlink's speed cap remains in effect.
kyivindependent.com/kyiv-den…
