News in Polish, translation below:

Police officers in Warsaw's Wilanów district intervened after receiving information from French authorities about online content that could indicate a threat to the lives and health of several people, as well as to the author himself.

The information suggested that the content might concern plans to carry out serious acts.

Shortly after 3 a.m. on Wednesday, police officers went to the address they had identified. They found a 47-year-old man there, along with a sleeping child.

The officers assessed the situation and spoke with the man. He confirmed that he had been having conversations using artificial intelligence. He explained that he had discussed various topics and developed theories during these conversations, but said that he had no intention of carrying out the plans he had described and considered them unrealistic.

According to the information passed to the authorities, the contents of the conversations had been flagged by the system as potentially representing genuine intentions and were subsequently reported.

During the conversations, the man described methods of mutilation and killing involving various weapons and substances. French authorities passed the warning to their Polish counterparts, allowing the situation to be checked quickly.

An emergency medical team was called to the scene. After an initial conversation and examination, the man was taken to hospital for a medical consultation. Following the consultation, a doctor decided that he should be admitted to a ward for observation.

The Lawful Access Act, also known as Bill C-22, is a proposed piece of legislation of the 45th Parliament of Canada.

Introduced by Gary Anandasangaree

I'm sharing this one because I'm curious what more knowledgeable people think about this one. Please take a peek at the article before joining the discussion, as my limited quote might have dropped useful information

The VPN industry runs on a promise. Pick almost any provider and the pitch is the same: "we don't keep logs." You hand over your entire internet connection and, in return, you get a pinky-promise that nobody is writing anything down.

For a lot of privacy-minded people, that promise stopped being good enough a while ago. A no-logs policy is only as honest as the company making it, and even an honest company can be hacked, subpoenaed, or quietly acquired.

Obscura VPN is trying to answer to that problem. Instead of asking you to trust its word, it splits the job across two independent companies so that neither one can tie your identity to your browsing. The first hop is Obscura's own servers; the exit hop is run by Mullvad. a respected VPM company out of Sweden. Your traffic is end-to-end encrypted to Mullvad's keys, so Obscura literally can't read it, and Mullvad never sees who you are.

Five years of your social media just to visit the US on an ESTA, and 50,922 phone searches at the border in a single year with no suspicion needed. Part 1 of my Five Eyes series: who else gets to see it?

I made up the title b/c the URL is to the court's finding. Doesn't have a title per se.

TLDR (ruling is 38 pages, so this is BRIEF gd!)

Driver was stopped for following too close. Officer gave warning, but no citation. Officer ran ALPR history, then searched car based on ALPR. Driver admitted to having marijuana in the vehicle, which officer said he didn't care about, and was only after hard drugs. ALPR history had driver driving a long distance for a short visit to the state.

Court ruled:

1. Traffic stop was legal and justified by observed violation. Officer had reasonable basis to stop driver.

2. The subsequent search was NOT constitutional, since officer did not have a warrant for ALPR data, and had no reasonable suspicion of criminal activity.

Result from ruling,

(Driver) has a reasonable expectation of privacy in the location data which tracked her movements over several weeks. .... The ALPR search was an unreasonable governmental intrusion of protected privacy rights.

Vehicle search result was quashed.

There's lots more nuance in the linked filing. Also citations. It's really good IMO. It balances the privacy of the driver's vehicle with the legit justification for the stop. It also notes how "persistent, dragnet surveilence" differs from other kinds. Kudos to judge Sara Hill for really good nuanced ruling, esp around pg 28+ of the ruling talking about constitutional issues.

It's long but totally worth a read. The case does not set a binding precedent.

The legal situation is FAR from perfect. But I hope just once we can have a thread where a ton of ppl don't immediately go, "this good privacy news is useless b/c it does not solve every single problem every single time!" It is evidence in favor of a slow but meaningful shift in ALPR jurisprudence. It stands along side recent SCOTUS rulings that also do that, like Chatrie v United States and Carpenter v United States.

I built a small open-source web app that lets people share Age-encrypted files using ordinary web hosting. The encrypted file can be hosted at any HTTPS URL, including a public or pre-signed URL for an S3-compatible object store. Decryption happens locally in the recipient’s browser.

Source: https://github.com/parsimonit/web-age-stream-decryptor Demo: https://decrypt-app.zebrastream.io/

The encrypted file stays on the existing server. The recipient opens a share link, and the file is decrypted locally in the browser for viewing or downloading. There’s no decryption backend.

The link contains the file URL and Age passphrase in the URL fragment, so the passphrase is not sent in the HTTP request. The complete link is still a bearer secret: anyone who gets it can decrypt the file.

I’m interested in feedback from people familiar with privacy tools and threat modeling:

• Is this useful compared with existing encrypted file-sharing tools?
• Are there important browser or URL-leakage risks I should document?
• Does the “static frontend + arbitrary encrypted object storage” model seem worthwhile?
• Should rendering decrypted HTML be disabled or treated as an unsafe feature?

Current limitations include buffering large files in memory and the possibility of script execution when decrypted HTML is rendered.

Another win for privacy <3