Hey @shl, I am a self-proclaimed DOGE for privacy. I like helping the American people protect their data and stay safer online. I looked at the IRS app's public privacy disclosures. Here's what I found. On Google Play, the developer-provided label lists crash logs, app interactions, and device or other IDs as data the app may collect and may share with other companies or organizations. For device or other IDs, it lists Analytics as the purpose. The App Store label says usage and diagnostic data may be collected for analytics but are not linked to your identity. It separately lists a user ID linked to identity for app functionality. Both listings link to the general IRS privacy policy. It covers IRS.gov and its online applications, but does NOT explain the mobile app's analytics practices. The IRS's public PIA index links “The IRS app” to an IRS2Go assessment approved in June 2020. That document predates this release and does NOT discuss analytics. With the app now offering tax records, notices, and bank account updates, could the IRS prominently link the current mobile app privacy notice and applicable assessments from its app page and store listings? It would help to know which providers receive which data, which identifiers are used and whether they can be linked to taxpayer accounts, how long the data is kept, and what users can turn off. It would also help to confirm that tax identifiers, bank details, document contents, and authentication tokens are excluded from analytics and crash reports. These are requests for clarity and verification. I only reviewed public pages and their expanded disclosures. The screenshots highlight the relevant disclosures.

Before buying a new router, check whether yours still receives security updates. If it does and the WiFi works well throughout your home, I would keep it. If you need a replacement, here are two options, depending on how much setup you are prepared to do. 1. For the simpler setup: GL.iNet Flint 2 (GL-MT6000). This would be my pick between the two for a beginner. It has Wi-Fi 6 and can be set up locally through a browser without creating a cloud account. Start with GL.iNet’s supplied firmware. Set a strong administrator password, leave cloud remote management disabled unless you specifically need it, and install stable updates through System -> Upgrade. Leave preview releases disabled. You are relying on GL.iNet for that firmware and its updates. It is based on OpenWrt, but it is not the same firmware maintained and released by the OpenWrt project. 2. For someone willing to learn network configuration: OpenWrt One. It comes with OpenWrt, an opensource OS for routers [already installed]. I would choose it for someone who specifically wants that software and is prepared for more hands-on setup. It has one 2.5GbE WAN port for the internet connection and one 1GbE LAN port for wired devices. To connect multiple wired devices, add a network switch to the budget. For most people, I would prioritize a router they can configure and keep updated over one that becomes a networking project just to get online.

An Indiana police officer searched Flock records covering 82,413 license-plate cameras. The reason entered in the audit log: “idk.” @EFF uncovered the May 7, 2025 search through public-records requests. Other searches listed reasons including “LOL,” “LMAO” and “WEIRD KID.” These cameras can record where your car was even when you are not suspected of a crime. Those audit entries give the public almost no explanation for why officers accessed that location data. Flock has since added a required dropdown for offense categories, which it says makes audits more consistent. Someone still needs to check whether the stated reason matches the actual purpose of the search. If your city uses Flock, who independently audits the searches, and can residents see the findings?

Researchers got two already-compromised computers to communicate through heat, without a network connection between them. One computer varied its heat output. The other detected those changes using built-in temperature sensors. In the 2015 BitWhisper experiment: - The machines were up to 40 cm apart. - Transfer rates were 1–8 bits per hour. - Both computers were already compromised. @polynoamial cites this academic example when discussing AI agents that are supposed to be isolated and independent. Coordination can require very few bits, so even a slow channel could matter. He calls air-gapping an extremely strong safeguard. His argument is that absolute guarantees about isolation are difficult, which is why safety protocols need independent layers of defense. One lesson from the @huggingface incident was that too much trust had been placed in sandbox isolation, with too few independent safeguards. What could those defenses look like? For physical communication channels, researchers discuss physical separation, zoning and activity detection. Their effectiveness depends on the channel and the environment being protected. Related research: “AI Control” paper tests monitoring, auditing and trusted-model editing against deliberate backdoor insertion in a limited coding setting. The broader argument is that safeguards can buy time while the alignment problem still needs solving. The question I would like to understand better: if isolation fails, which other safeguards still hold, and how have they been tested against agents trying to defeat them?

I do NOT consider stock Firefox privacy-respecting by default. I reviewed Mozilla’s privacy notice and technical documentation. These are the details users should know. - Search suggestions are enabled by default in normal browsing. They send your search text to your selected search provider as you type, before you submit it. Where Google is the default, those requests go to Google. - Firefox also collects telemetry by default. Mozilla documents client and profile-group identifiers in some telemetry pings, explicitly designed to correlate reports. Those identifiers allow telemetry reports to be linked to a browser profile. That alone does not establish that browsing history is being uploaded, but it does make linkability a concrete privacy concern. - Turning off the main technical and interaction data setting does NOT disable the separate daily usage ping. That ping has its own opt-out. Mozilla says it excludes browsing history. Users should not have to discover this distinction after believing they have disabled usage reporting. - There is also a difference between Firefox’s default tracking protection and its stricter configuration. In Standard mode, “tracking content” blocking applies only to Private Windows. Extending that protection to ordinary windows requires Strict or Custom mode. Firefox has meaningful protections, including Total Cookie Protection enabled by default. Those deserve credit. My criticism is specific: search text leaves the browser while you type, some telemetry supports correlation across reports, usage reporting has separate controls, and broader tracking-content blocking requires a settings change. These defaults fall short of what I expect from a browser marketed as private by default. Sources from Mozilla in the reply.