Apple Fixed A Leak Without Telling Anyone. Plus More VPN News

Summary of Main Arguments and Key News

VPNs and network privacy (mostly positive)

• Mullvad adds “multi-hop modes” with options: Always / Never / When needed.
  • When needed automatically enables multi-hop via a nearby compatible entry server, then exits via the user’s chosen location, with UI indicators.
• Obscura VPN for Windows is highlighted as an expansion of a provider inspired by Apple Private Relay-style trust distribution—aiming so that neither side knows the other’s information.
  • The show also notes device limit increases and a launch discount.
• Firefox VPN is reported as a native Firefox extension offering 50GB free, expanding to Firefox for Android (with iOS support implied as forthcoming).
  • The segment emphasizes browsing-only protection, not a replacement for system-wide paid VPNs.

Apple “quietly” fixes a privacy leak—without transparency

• The show revisits an earlier issue: Apple allegedly leaked DNS queries, discovered by privacy researchers and presented as disclosed by Silo developers after observing DNS leaks.
• Core criticism: Apple fixed the problem quietly, with no mention in security release notes or beta context.
  • This is framed as undermining trust in a feature Apple markets as privacy/security-focused.
• A verification subdomain in Silo is referenced to test exposure.

Expanded surveillance via AI-enabled policing (Flock / ALPR)

• A forthcoming segment focuses on Flock Safety (automatic license plate readers) and Wired’s reporting that Flock’s code and an AI system can:
  • Identify drivers/track vehicles by movement patterns
  • Potentially support queries like: “find witnesses based on vehicles most seen in a neighborhood”
  • Help map plates to more personal data (claimed: names/addresses/relatives)
• The presenter argues this goes far beyond “situational use” and instead enables persistent dragnet-style tracking, raising a possible Fourth Amendment concern.
• Advocacy/action references include defloc.org and a satirical example shown at a city council meeting (featuring “Darth Vader”).

Social media harms, settlements, and age-gating regulation

• Meta settlement (~$17–18B) over alleged harms to children is described as large, but not fully satisfactory from a rights/privacy perspective.
  • EFF criticism: embedding age assurance into products and increasing personal data collection could weaken privacy/anonymity and increase future risk from breaches or government requests.
• New Zealand proposes teen social media restrictions: platforms must confirm users are over 16 (Instagram, TikTok, Snapchat, Facebook named).
  • The presenter notes it may take time to pass and urges early activism.
  • Australia is cited as an example where such restrictions have been bypassed, while data collection still increases.

Open-source frontends for X/Twitter hit by takedown

• Knitter and XCancel (frontends aiming for privacy and avoiding logins) are described as being forced offline after X Corporation cease-and-desist demands to take down:
  • Instances
  • The repository
• The presenter argues this is fundamentally about control and ad ecosystems:
  • Driving users toward account-based access enables platforms to enforce rules, track behavior, and monetize via ads.
• Broader guidance: frontends can improve access and privacy, but don’t solve root platform control. Creators should maintain “off-ramps,” such as independent instances (the show mentions PeerTube).

Data breaches and threats (Defense Bulletin)

Breaches

• New Techs Health (hospital operator): reported data theft (mostly Texas/Wisconsin), with details still being assessed.
• LACMA: a previous year’s breach reportedly exposed extremely sensitive identifiers (including SSNs, DOBs, and government IDs), plus medical and financial-related data.
  • The presenter questions delayed disclosure and suggests freezing credit.
• Apollo private equity: confirmed breach during broader hacking waves targeting financial firms; exposed names, DOBs, contact details, addresses, and SSNs (victims not specified).

Threats flagged

• WordPress attacks involving MiniOrange auth bypass, and another campaign targeting Avada with zero-click RCE.
• Ubiquiti/UniFi OS vulnerabilities patched for severity issues.
• Boston Scientific: cyberattack causing global disruption, affecting supply chain delivery; unclear whether implanted medical devices are affected.
• Phishing via abused NPM mirrors.
• Concern about advertising/tracking in smart monitors (LG/McAfee ads mentioned).

“Rogue AI” hacking narrative corrected

• The show challenges early panic about AI agents “going rogue”:
  • Incidents are described as long chains of attacks still relying on human involvement.
  • The presenter argues the novelty is mostly in tooling; the underlying issue is big-tech operational carelessness and weak monitoring—similar to past large-scale security failures.
• A researcher’s perspective is mentioned: a single diligent person might have noticed or prevented issues, but tracking everything across parallel OpenAI work is hard without strong safeguards (including references to OpenAI and Anthropic in the discussion).

Open-source and privacy-relevant updates

• Waterfox 6.7.1: fixes/fine-tuning after a redesign, plus new ad blocker work.
• Firefox roadmap: enabling JPEG XL decoding by default in Firefox 157 for performance/security reasons.
• Signal Desktop: adds Linux ARM64 support (beta), expanding availability for ARM-based Linux setups.
• Mastodon 4.7: encrypted private keys, smoother migrations, fediverse protocol updates; Mastodon 5.0 planned later this year.
• Tuta/Tuda Calendar: adds time zone support.
• Apple Hide My Email change reversed: Apple previously planned to shift aliasing to private.icloud.com, which would reveal alias usage; the presenter says Apple will keep it on iCloud.com, preserving anonymity.
• MISC team blog (“Thoughts on Reasonable Disclosure”): discusses why they disclose vulnerabilities even while preferring vendor responsiveness—criticizing Apple for ignoring researchers.
  • The disclosure rationale ties to keeping people safer via public information and quiet patches.

Advocacy and personal/community framing

• The presenter frames much of the work as “homework”, including:
  • Contacting politicians about teen restrictions
  • Checking ALPR maps
  • Verifying Apple leak status
  • Freezing credit after breaches
• Closing theme: privacy work benefits from sustainability and focus—encouraging breaks rather than constant tool churn (referencing “take a break” framing from Privacy Dad).

---

Presenters or Contributors (named in the subtitles)

• Henry / “Sweaty Henry” (main host/presenter)
• Carl (runs Obscura, interviewed on Techlore Talks)
• MISC developers (DNS leak findings referenced)
• EFF
• Wired
• Meta
• OpenAI
• Anthropic
• Apple
• Silo
• Mozilla
• Signal
• Mastodon developers
• Waterfox
• Tuta/Tudanota Calendar team
• X Corporation / X (Twitter)
• Knitter
• XCancel
• Darth Vader (satirical figure shown in the city council meeting segment)
• Privacy Dad (blog author mentioned)