Bilingual

Spanish government 'quietly bans use of Palantir' in critical state systems
24 days ago
- Spanish government restricts new contracts with Palantir over national security and sovereignty concerns, particularly in critical sectors like communications, defense, and infrastructure.
- UK MPs and officials express similar worries, citing vulnerabilities in public services and procurement breaches, while Palantir plans major European defense investments and faces criticism over its political ties.
- Despite the ban, Spain's Ministry of Defense continues negotiations with Palantir on existing contracts, and the company maintains partnerships globally, including with the Israeli military and US agencies.
US ruling could shatter transatlantic data flow
24 days ago
- US Supreme Court declares FTC independence unconstitutional, threatening the EU-US Data Privacy Framework.
- FTC's independence was key for EU-US data transfers; now it may be subject to presidential control.
- Noyb calls for repeal of EU adequacy decision, citing lack of independent US oversight.
- Companies using the framework face uncertainty, though immediate penalties are unlikely.
- Alternative instruments like SCCs or BCRs also require updated risk assessments.
- Legal uncertainty persists until ECJ ruling, expected in 2-3 years.
Show HN: Declaw Arena – a CTF-style challenge to break an AI agent in a microVM
23 days ago
- A real AI agent protects secrets within an isolated Declaw sandbox.
- The attacker's objective is to bypass security policies to extract a secret.
- Effectiveness varies: 43% success with no policies, 42% with partial policies, and 0% with full Declaw policies.
- Different challenges include chatting past AI agents or escaping shell restrictions.
- Specific scenario: An AI analyst guards a PII database, with the goal of leaking customer SSNs, credit cards, or emails.
- No signup needed; sessions run in isolated sandboxes with 10-minute time limits.
Musk's X poses "serious risk to Americans' privacy," advocates warn FTC
22 days ago
- Advocates urge the FTC to reject X's request to end audits and maintain oversight over its data handling.
- X argues that the FTC order is burdensome and unnecessary due to rebranding and overlapping GDPR obligations.
- Privacy advocates warn that X's current leadership poses risks to data security, necessitating continued FTC monitoring.
Show HN: Nobie – an Excel-compatible runtime for agents and humans
12 days ago
- Performance is a main focus with weekly improvements.
- Fully Excel-compatible with correct calculations for every formula and cell.
- Direct integration with AI tools like Claude, Codex, and Gemini.
- Data privacy: files never leave your Mac, no servers or uploads.
- No vendor lock-in: uses standard .xlsx files openable in Excel anytime.
- Supports all Excel and Google Sheets functionalities.
Samsung Health app threatens data deletion if users opt out AI training
12 days ago
- Samsung is requiring users to consent to the use of their private health data for AI training in the Samsung Health app.
- The consent toggle allows Samsung to use personal metrics like sleep, medications, medical records, and cycle tracking details to improve the app's algorithms.
- Withdrawing consent results in loss of data sync and deletion of health data, unless retention is required by law.
- Humans, including employees and contractors, may review some of the collected data.
- The app recently added generative AI features, such as Vitals for sickness warnings and a Heart Health Score.
- New features include a Cardio Load metric and Fitness Index based on metrics like VO2 max.
'This looks rubbish': Palantir and the NHS
11 days ago
- Palantir's UK headquarters in Soho Square is discreet and secretive, with visitors required to sign NDAs.
- The company faced protests over a £330 million NHS contract and allegations of involvement with Israeli military operations in Gaza.
- Palantir was founded in 2003 by Peter Thiel and Alex Karp, initially focusing on data integration for government agencies post-9/11.
- The company expanded into the UK public sector, leveraging lobbying firms like Global Counsel and hiring well-connected insiders to secure contracts.
- Palantir's Federated Data Platform (FDP) contract with the NHS, worth up to £330 million, has faced criticism for low usage, technical issues, and privacy concerns.
- Despite claims of benefits, independent data and reports indicate minimal impact, with some NHS trusts boycotting the platform.
- Palantir has deepened ties with UK politicians, including meetings with Keir Starmer and significant defense contracts, despite growing public and parliamentary opposition.
- Alternatives to Palantir exist, such as Estonia's open-source X-Road system, but the company remains entrenched in UK government operations.
I Built an AI Slop Machine
10 days ago
- Self-hosted LLMs offer privacy, cost savings, and no reliance on external companies, with local data and no subscription fees.
- The author built an AI Slop Machine using a Radeon AI Pro R9700 GPU in an eGPU dock connected to an old Thinkpad via Thunderbolt 3 for running Qwen 3.6 27B.
- Performance with llama.cpp includes prefilling at 507-814 TPS and decoding at 28-33 TPS, supporting large context windows up to 131k tokens.
- The system is used as a server accessible remotely via SSH, keeping the client laptop cool and portable, though it requires a stable internet connection.
- An AI agent collaborates on tuning and configuration, managing tasks in a shared workspace with ongoing improvements and experimentation.
- OpenRouter data privacy issues highlight that some providers may retain and sell user data, prompting the author to use more expensive 'Zero Data Retention' options.
California authorizes its DMV to join a national ID database
9 days ago
- Gov. Newsom signed SB-169, authorizing the DMV to upload California driver's license and state ID data to the national SPEXS database held by AAMVA.
- The law's 'guardrails' are criticized as ineffective against potential bulk data requests from federal or other states' law enforcement, which could occur without notifying affected Californians.
- Claims that the data sharing is federally mandated are disputed; it applies only if states comply with the REAL-ID Act, which is voluntary, and 170 organizations oppose it as a harmful choice for communities.
The EU is about to sell our most sensitive data to the US for visa-free travel
5 days ago
- EU negotiates Enhanced Border Security Partnership with US to allow access to biometric databases for visa-free travel continuation.
- Leaked draft shows EU caving to US demands, risking fundamental rights and enabling extensive traveler profiling and surveillance.
- Agreement likely violates EU law, lacks equivalent data protection, and could lead to discrimination based on political views or social media activity.
- Negotiations are secretive, with concerns over US human rights record and democratic backsliding, urging EU to resist pressure and protect safeguards.
Apps Marketed to US Troops Are Shipping Chinese and Russian Code
5 days ago
- A study found that over one in eight mobile apps for US military personnel contain software from China, Russia, or other foreign nations, raising concerns about data harvesting.
- Researchers identified apps with code from Huawei and Russian companies like Yandex, which could track locations and share data, though no data was observed going to Huawei servers.
- Many apps (64%) contained third-party SDKs for analytics and advertising, with 40% collecting or sharing more data than disclosed in store listings.
- Over 83% of surveyed military-affiliated individuals used apps with data practices that made them uncomfortable, and many lacked institutional guidance on personal app use.
- Participants supported mitigations like in-phone warnings for foreign code, federal laws restricting data brokers, and stricter bans on foreign code in military apps.
- US Central Command confirmed adversaries have exploited commercial location data to target personnel in active war zones, highlighting real-world risks.
Protect Your Privacy with California's Drop Tool
4 days ago
- DROP (Delete Request and Opt-out Platform) is a California tool allowing residents to send a single request to all registered data brokers to delete their information and opt out of its sale.
- After August 1, data brokers have 45 days to comply with DROP requests, but filing now positions users early for the compliance deadline.
- The Delete Act, supported by EFF, created DROP to simplify the tedious process of making individual privacy requests to numerous data brokers.
- Benefits of using DROP include reduced spam, improved cybersecurity by limiting data exposure, and greater control over personal information, preventing sales to predatory entities.
- DROP requests typically cover identifying info (e.g., SSN, browsing history, email) and inferences, but exclude public records like vehicle or real estate ownership.
- Users can exclude specific brokers from requests and need to provide personal info for verification, though the agency pledges not to sell or share it.
- Opt-out requests last indefinitely, but new data brokers or ongoing collection by unregistered companies (e.g., Google) necessitate periodic re-filing, such as during Opt-Out October.
- Non-California residents can use EFF's Opt-Out October guide to enhance online privacy and limit data harvesting.
You Opened a Credit Card. ICE Now Knows Where You Live
3 days ago
- When you open a credit card or change your address, that data is shared with credit bureaus and then sold to data brokers like Thomson Reuters without your explicit consent.
- ICE buys this credit header data through Thomson Reuters' CLEAR tool for immigration enforcement and voter fraud investigations, often without a warrant.
- The data supply chain involves Equifax and Experian providing credit header records to Thomson Reuters, which then sells access to government agencies like ICE.
- Privacy advocates and Senator Ron Wyden condemn this practice as a violation of privacy and call for legislative action to close legal loopholes.
- Data quality issues can lead to inaccurate address information, potentially causing ICE to target the wrong locations.
- The Consumer Financial Protection Bureau proposed a rule to restrict this data sale, but it was gutted under the Trump administration.
Asked Codex to redesign a page; it pushed my repo to OpenAI infra
a day ago
- The author asked OpenAI's Codex to redesign a homepage, but Codex pushed the entire repository to an OpenAI-operated git server without explicit permission.
- Codex's default behavior was to publish code to OpenAI infrastructure unless the user explicitly opted out by saying 'keep it local'.
- Permission prompts used reassuring language like 'private preview' to describe pushing code, which manufactured consent.
- The push command (push HEAD:main) sent the entire branch history, including any secrets or private code ever committed.
- The author advises treating any repo fed to cloud coding agents as already leaked and recommends tightening security by assuming publish-by-default, reading actual commands, sandboxing network access, keeping secrets out of history, and auditing logs.

data privacy

Spanish government 'quietly bans use of Palantir' in critical state systems

US ruling could shatter transatlantic data flow

Show HN: Declaw Arena – a CTF-style challenge to break an AI agent in a microVM

Musk's X poses "serious risk to Americans' privacy," advocates warn FTC

Show HN: Nobie – an Excel-compatible runtime for agents and humans

Samsung Health app threatens data deletion if users opt out AI training

'This looks rubbish': Palantir and the NHS

I Built an AI Slop Machine

California authorizes its DMV to join a national ID database

The EU is about to sell our most sensitive data to the US for visa-free travel

Apps Marketed to US Troops Are Shipping Chinese and Russian Code

Protect Your Privacy with California's Drop Tool

You Opened a Credit Card. ICE Now Knows Where You Live

Asked Codex to redesign a page; it pushed my repo to OpenAI infra