Researchers at TrendAI concluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX's Starlink service and that the ads were likely being used to geolocate or otherwise surveil them.

https://www.reuters.com/business/media-telecom/alleged-israeli-spy-company-heavily-targeted-starlink-users-sources-say-2026-10-27/

@datarama @m @silverwizard You have correctly noticed that I am mixing my religious paradigms.

@sus This is also what I am hoping for.

@UlrikNyman The very short version is that the attack surface is nearly infinite while resources are extremely finite.

I understand that there are people who think we must pass through the Vulnpocalypse to get to Vulnhallah, a time when all code is written by AI then checked by AI and has no vulns that AI can find, while we sit back and feast. But I don't think we can get there from here.

Another day, another story where my work on mass surveillance overlaps with my work in domestic abuse in the most terrible goddamn way.

WaPo found cops who kept using Flock to spy on women after they left the force.
One used it for five years after retirement, tracking his wife during a custody battle.
Another ran searches while he was suspended (and later fired) after killing a 15-year-old boy.

https://www.washingtonpost.com/technology/2026/10/21/their-police-jobs-ended-they-kept-using-flocks-vast-surveillance-network/?pwapi_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZWFzb24iOiJnaWZ0IiwibmJmIjoxNzkyNTU1MjAwLCJpc3MiOiJzdWJzY3JpcHRpb25zIiwiZXhwIjoxNzkzOTQxMTk5LCJpYXQiOjE3OTI1NTUyMDAsImp0aSI6IjkzNGFjMDEwLTQyMWQtNGNhNy04ODlkLTE4ZTQzZjBhZjE2ZiIsInVybCI6Imh0dHBzOi8vd3d3Lndhc2hpbmd0b25wb3N0LmNvbS90ZWNobm9sb2d5LzIwMjYvMTAvMjEvdGhlaXItcG9saWNlLWpvYnMtZW5kZWQtdGhleS1rZXB0LXVzaW5nLWZsb2Nrcy12YXN0LXN1cnZlaWxsYW5jZS1uZXR3b3JrLyJ9.8ifuXWrPb_08oQYHEMV1iv0ogHP6b_oJLriFrDpLt68

@nemo You are correct in describing the trade-offs.

"This report exposes zero-click spyware delivered via targeted ads, which we call AdFection, and is the first technical demonstration that mercenary spyware is being distributed via targeted advertisements."

True. All of the other examples I can think of involve govts that roll their own malware.

@nemo For iPhones, Lockdown Mode. Also, adblockers. May I interest you in EFF's Privacy Badger?

Additional highlights from the Citizen lab report include:

"Discover-Tech...also leveraged the European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union."

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

@tphinney I can think of some workarounds, but I also think that harassing 25k people is bad.

ChatGPT now lets you target ads based on specific prompts or any phone number or email address. This is absolutely 100% going to be used for harassment.

https://www.404media.co/how-chatgpt-targets-ads-to-you-based-on-your-prompts-phone-number-and-email/

A lot of people I know shared posts about the Yandex datacenter bombing resulting in a decrease in Russian misinformation/disinformation bot activity, sometimes with charts. Let this be a reminder every one of us could be fooled by a story that we really want to be true.

@kevingranade The "case by case basis" language suggests that they think human review is going to prevent them from sending the vuln report to a bad actor. I am much less confident in their abilities.

@bagder Because your options are "more reports than you can possibly triage" or "someone finds a.vuln and either exploits it or sells it to bad people."

I understand that Anthropic thinks they're doing open source projects a favor here, but what they're actually doing is creating an enormous amount of work for people that they are not paying.

https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source