Dean Pierce
@deanpierce.net
Security Research in Portland, Oregon #HackThePlanet 🧑💻🌎🌍🌏
c/o @deanpierce.net , Crowdstrike naming for AI evals is Goat: - OpenAI: Stubborn Goat - Anthropic: Prissy Goat - Microsoft: Baffled Goat
Tons of peoples' Claude chats are exposed on Google. Cryptocurrency keys, API keys, login credentials, legal discussions, more. This happened with ChatGPT last year. And Claude too. There's clearly an ongoing issue with search engines indexing peoples' AI chats www.404media.co/tons-of-peop...
Tons of Peoples’ Claude Chats and Creations are Exposed on Google
Claude users are creating public share links, but probably don't realize that means their chats are now ending up in Google searches where anyone can dig through them.
404media.co
Can online voting stay anonymous, AI remain open and mesh messaging survive government pressure? This week: Freedom Tool, Google’s face-video recovery, open-weight AI, rollup security councils, Bitchat in India and more. Read Web3Privacy Now: news.web3privacy.info/2026-31/
Woah this looks amazing 😍 Help fund the launch of this incredible looking community space opening up in Portland: seedandspark.com/fund/flannel...
Flannel Donut Studio Café - Film and Storytelling | Seed&Spark
Portland is one of the greatest stop-motion animation cities in the world—but most of that work happens behind closed doors. The Flannel Donut Studio Café is a working studio, café, event & screening ...
seedandspark.com
I cannot support a blank check for Trump's illegal war in Iran and fast-tracking deeply troubling and dangerous surveillance collaboration with Netanyahu’s government. I voted no.
Senate Democrats have blocked Republicans' National Defense Authorization Act, which would've given an additional $1,100,000,000,000 to the Department of War and deepened military ties with Israel
Earlier this year, during Iran's internet blackout, I couldn't reach my own family. My messages weren't being blocked, there was simply nothing on the other end to deliver them to. So I did the only thing I know how to do. I rage-coded. That project is MoaV -… firefly.social/post/ff-519733...
Continue reading on Firefly.Social
Earlier this year, during Iran's internet blackout, I couldn't reach my own family. My messages weren't being blocked, there was simply nothing on the other end to deliver them to. So I did the only thing I know how to do. I rage-coded. That project is MoaV - Mother of All VPNs - and today I'm sharing its 1.9 release. → Server: https://github.com/MotherofallVPNs/moav → Client: https://github.com/MotherofallVPNs/moav-client → https://moav.sh MoaV is a self-hostable, multi-protocol anti-censorship server. One command, a small VPS, you have 16+ circumvention protocols running. Here's what shipped since v1.8.5: 🛡️ Harder to detect. wstunnel now wraps WireGuard in real TLS. DNS tunneling. 🔐 Reliability. TLS certificates automatic renewal. Fixed an entire class of update bugs. 📡 Network tuning, built in. 🖥️ A native client. takes a single bundle, probes every endpoint e2e, and load-balances with a dashboard. 🧪 Full CI E2E testing. #InternetFreedom #OpenSource
firefly.social
There's no reforming this rogue and monstrous agency. The only way forward: Abolish and prosecute ICE.
San Francisco police accidentally livestreamed their drones’ video and data on the open web. The hours of footage—including several apparent arrests—should never have been made public, but now offer a glimpse of modern aerial urban surveillance. www.wired.com/story/sfpd-d... w/ @dmehro.bsky.social
A Leak of San Francisco Police Drone Footage Exposes the New Reality of Urban Surveillance
The SFPD’s exposure of hours of videos from drone platform Skydio reveals how broadly it’s watching the city from above—and how the results can spill online.
wired.com
Speaking soon at #ToorCamp about the Portland Hacker Foundation (pdxhf.org) 🏕️ slides: deanpierce.net/talks/portla...
Portland Hacker Foundation
PDXHF collects tax-deductible donations and funds microgrants for the Portland hacker community.
pdxhf.org
I really think that unless something changes very soon active--effective--direct action that will stop data center build outs and functionality is inevitable.
the public meetings around data centers are getting .... heated?
also omg it is wild to say this but we sent out over 1.5 million whistles
The trailer for David Wain’s hilarious new comedy “Gail Daughtry and the Celebrity Sex Pass” just dropped - check it out on YouTube. Looks like I made the final cut!
‘Masters of the Universe’ drone show spotted over Los Angeles 💥 • Had 1600 drones • Guinness World Record for brightest drone show ever (via Amazon MGM)
www.bleepingcomputer.com/news/securit... "don't use scary china apps, because their government can access your data and that's a privacy risk" friendly reminder from US cops that you're better off under the palantir/google panopticon; make sure the creeps reading your DMs are all-american 🇺🇸
FBI warns against using Chinese mobile apps due to privacy risks
The U.S. Federal Bureau of Investigation (FBI) warned Americans against using foreign-developed mobile applications, particularly those created by Chinese developers.
bleepingcomputer.com
Apple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.
Tired of the constant vuln noise? 📢 Mark Lambert (ArmorCode) & Tod Beardsley (runZero) discuss how to ‘Mute the sirens’ with intel and context during their recent runZero Day session. 🎥 Watch the replay today to learn more! www.runzero.com/resources/pr...
Keyed nonces are not just a way to add stronger in-protocol support for privacy solutions. They are also a potential first foray into a new state scaling strategy for Ethereum: create new types of storage that are more… https://firefly.social/post/ff-556bd7e35ea64383af98efa6e6c975c2?s=bsky
Continue reading on Firefly.Social
Keyed nonces are not just a way to add stronger in-protocol support for privacy solutions. They are also a potential first foray into a new state scaling strategy for Ethereum: create new types of storage that are more optimized for handling categories of use cases that we care about, with restrictions on their use that make them usable at extreme scale while preserving the protocol's decentralization. Let's zoom in on this case (in-protocol nullifiers). Let's say we get to 2000 TPS of privacy-preserving transactions onchain, for eight years. Then we get 2^11 tx/sec * 2^25 sec/year * 2^3 years = 2^39 [ie. 500 billion] nullifiers stored onchain (the challenge with nullifiers is that they are fundamentally not possible to prune). It's actually far easier to keep Ethereum decentralized if we have 500 billion nullifiers onchain in a dedicated nullifier store, than if we just let them grow in the current state. The reason is that the more restrictive structure of nullifiers (only used to check validity, and we can require the nullifier ID to be explicitly specified in the tx) enables more decentralized ways of handling them. This includes: * Sharding: each node (incl builders) can hold a small percentage of nullifiers, and make sure to have a connection to an honest peer in each other shard * Bloom filters: see this somewhat wacky idea here for reducing the VOPS requirement for nullifiers to ~8 bits per nullifier: https://docs.fileverse.io/d/020001fc0012#k=UT7Btd6tyqHgOj47t-TX06F8D6OpcpM_2PKdf7s4tGE Both techniques are not possible to use for dynamically accessible state. And so builders would have to download the full 16 TB to become viable (not just optimal, viable!), and privacy protocol users would not be able to use FOCIL without providing a Merkle branch proving that their nullifier is unspent, and there would be very few nodes capable of providing such a branch... Zooming back out, the moral of the story is that fully dynamic state is much harder to handle at extreme scale (tens to hundreds of TB) than state that is more controlled and restricted in how it can be used. And so if we can move the majority of usage into these more specialized forms of state (which we can make much cheaper in terms of gas), then we can keep Ethereum decentralized, and highly scalable, and keep the fully dynamic state available for applications (eg. defi) that really need its full functionality.
firefly.social
The Internet Archive, Wikimedia, academics, and hobby archivists are having trouble finding hard drives or are having to pay extremely high prices for them.
The AI Hard Drive Shortage Is Making It More Expensive and Harder to Archive the Internet
The Internet Archive, Wikimedia, academics, and hobby archivists are having trouble finding hard drives or are having to pay extremely high prices for them.
404media.co
Residents of an Atlanta suburb learned that Flock had been accessing cameras in the town—including in a children's gymnastics room—to demonstrate the company’s surveillance technology to police departments around the country. The city renewed the contract anyway. www.404media.co/city-learns-...
Congratulations to Liban Mohamed on winning the Democratic nomination in UT-01. 🥳 Join me in supporting his people-powered campaign!
Exploit Workshop is in 6 days at PDX Hackerspace on April 29, 2026 at 06:30 PM. Join us! More info →
PARTS - Portland Area Robotics Society is coming up on May 03, 2026 at 10:30 AM at PDX Hackerspace. Open to the public and everyone with an interest in robotics. Please join us! More info →
Teen suicide rates are down 11% since I helped create the national teen suicide hotline. Republicans are actively trying to defund it so they can pay for Trump's war in the Middle East. They don't care if kids die as a result as long as they get their oil.
Nearly 4,400 fewer U.S. teens and young adults died by suicide than projected in the first two-and-a-half years of the 988 mental health crisis hotline, a sign the program is working even as it faces long-term funding challenges. https://to.pbs.org/4cFt4ao