MoreRSS

site iconAlec MuffettModify

Alec is a technologist, writer & security consultant who has worked in host and network security for more than 30 years, with 25 of those in industry.
Please copy the RSS to your reader, or quickly subscribe to:

Inoreader Feedly Follow Feedbin Local Reader

Rss preview of Blog of Alec Muffett

Australian Government will “not be intimidated by threats, not be intimidated by legal challenges” … brought by Aussie teenagers who don’t want to be censored

2025-11-26 19:23:44

It’s the response from the Australian Government that tells you what they really think of the young people they claim to be protecting:

Teens launch High Court challenge to Australia’s social media ban


However, 15-year-olds Noah Jones and Macy Neyland – backed by a rights group – will argue the ban completely disregards the rights of children.

“We shouldn’t be silenced. It’s like Orwell’s book 1984, and that scares me,” Macy Neyland said in a statement.

After news of the case broke, Communications Minister Anika Wells told parliament the government would not be swayed.

“We will not be intimidated by threats. We will not be intimidated by legal challenges. We will not be intimidated by big tech. On behalf of Australian parents, we will stand firm,” she said.

https://www.bbc.co.uk/news/articles/c9d9l7w1g8yo

The first #AgeWall ? Substack is introducing Age Verification to cut UK people off from seeing “Potentially Harmful” Substack content

2025-11-26 19:10:26

Paid subscribers get a bypass, of course:

Why is Substack asking to verify my age?

The UK Online Safety Act requires restricted access to content that could be considered sensitive for younger audiences. If you see blurred or blocked content, this doesn’t necessarily mean that the content is harmful, it just may fall into a category that must be age-restricted per the requirements of the OSA.


Verification in the UK is optional, however, without verification, you may continue to come across blurred content or be blocked from accessing certain features (a Substack’s chat, DMs, livestreams) with a prompt to verify your age thus limiting your Substack experience.

Yeah, really…

If Ofcom want to stop UK people visiting a non-UK website, they need to stop the UK people, not tell the non-UK website to work to prevent the UK hordes

2025-11-26 18:55:06

This should be obvious, no?

It’s how we deal with football hooligans:

Football (Offences and Disorder) Act 1999 (Notes)

…The measures proposed would provide recourse to the law to prevent a range of offenders from attending matches in this country and travelling to and attending designated matches abroad.


One could try to argue “Yes but we have regulations to force football teams and stadia to stop hooligan violence…” — and yes we do, but that regulation applies only to the UK; the foreign teams & stadia have their own laws.

Maybe they’re looking for a way to avoid painting all Britons as potential Internet hooligans?

X/Twitter exposing user location in such a safety-positive way makes a modest dent in the EU’s approach to protecting personally-identifiable information

2025-11-26 18:38:31

I’m confident a few privacy activists across Europe are seeking GDPR (etc) arguments to critique the mechanisms behind the location-based exposure of “Foreign, Fake MAGA Agents”; I disagree, but I think there will be ripples of positive & negative consequences until a new norm is established & understood. Of course I’m not the only one thinking this:


Another former employee, speaking on condition of anonymity because they are not authorized to speak about their work at X by their current employer, said the company had decided against deploying the idea in the past for two reasons: concern about creating a visible target for bad actors to manipulate and fear that the label could backfire. If a bad actor successfully spoofed a U.S. location, the platform would effectively be incorrectly verifying it as a trusted American voice.

It’s pretty simple:

  • the fakes will adapt to look more credible
  • the readers will trust the adaptations
  • even greater transparency will be sought or demanded:
  • user-via-vpn, user-via-tor-over-vpn, exposure of source IP’s “reputation”, deanonymisation via reputation-mapping attacks, GDPR lawsuits, exposure of source IP, faked source IPs, …
  • lather, rinse, repeat forever

The only way to break this loop is not to play the game, but we’re not in that universe at the moment.

However: there are some worthwhile zingers in the comments, here:

Reddit:

Nikita Bier, X’s head of product development, said they’re working to resolve the use of VPNs to alter account location. How?

Software companies must be held liable for British economic security, say MPs | The Record

2025-11-25 20:52:29

Well this is misconceived and is going to end badly, if it goes anywhere at all. Perhaps the British people ought to be able to sue members of parliament for losses caused by legislation?

https://therecord.media/software-companies-liable-britain-security

“Key Management” is the cryptographic community’s version of “…it’s always DNS”

2025-11-21 21:18:15

International Association for Cryptologic Research runs secure vote and then loses the keys so nobody knows what the result is. As one commenter put it: “So a single member can collude to reset the vote?”