How hard could it be to make a chicken coop door that can be configured to open and close automatically using a straightforward interface? That’s the question that [Jeff Sandberg] set out with, after three years of using a more basic off-the-shelf unit that offered no remote access nor a convenient user interface. The use case for [Jeff] was rather straightforward: the door would be open during the day and closed at night to keep the hens safely inside the coop.

The commercial solution offered an RTC-backed programmable interface as well as a light sensor, but the latter wasn’t always reliable in inclement weather and making simple changes to the programming when e.g. the hens had to stay inside a day due to work on the yard, was much more complicated than needed, plus had to be done on the spot. The new system would solve all these ills.

That said, the existing door mechanism was doing a fine job and could be kept. This just left making a new box with electronics to control it, starting with an ESP32C3 with the ESPHome firmware that is hooked into the local Home Assistant system, along with a motor to lift and lower the door and with magnetic contact sensors.

So far so easy. The hard part came with the installation, which involved trenching to the hen house for mains power, repairing the damage from this, and troubleshooting a power issue that turned out to be due to a dodgy power adapter. The payoff is that now the chicken coop is also part of the smart home and their owner never has to trudge through a soggy garden again to adjust the programming on a dim LC display with far too few buttons.

hackaday.com/2025/06/13/how-a-…

Today in old school nostalgia our tipster [Clint Jay] wrote in to let us know about this rotary dial.

If you’re a young whippersnapper you might never have seen a rotary dial. These things were commonly used on telephones back in the day, and they were notoriously slow to use. The way they work is that they generate a number of pulses corresponding to the number you want to dial in. One pulse for 1, two pulses for 2, and so on, up to nine pulses for 9, then ten pulses for 0.

We see circuits like this here at Hackaday from time to time. In fact, commonly we see them implemented as USB keyboards, such as in Rotary Dial Becomes USB Keyboard and Rotary Dialer Becomes Numeric Keypad.

One thing that makes this particular project different from the ones we’ve seen before is that it doesn’t require a microcontroller. That said, our hacker [Mousa] shows us how to interface this dial with an Arduino, along with sample code, if that’s something you’d like to do. The schematic for the project shows how to connect the rotary dial (salvaged from an old telephone) to both a 7-segment display and a collection of ten LEDs.

The project write-up includes links to the PCB design files. The guts of the project are a 4017 decade counter and a 4026 7-segment display adapter. Good, honest, old school digital logic.

youtube.com/embed/vfpyyLdcTk4?…

hackaday.com/2025/06/13/adapti…

Negli Stati Uniti, due membri del gruppo di criminali informatici ViLE, specializzato nell’ottenimento e nella vendita di informazioni personali, nonché nell’estorsione e nelle minacce alle vittime, sono stati condannati. L’episodio centrale del caso è stato l’hacking di un portale sicuro utilizzato per lo scambio di dati tra le forze dell’ordine federali e locali.

ViLE operava secondo uno schema collaudato: otteneva dati personali – inclusi numeri di previdenza sociale, patenti di guida e indirizzi – per poi ricattare i proprietari di queste informazioni.

L’arsenale dei partecipanti includeva non solo false richieste legali ai social network, documenti d’identità falsi e operatori di supporto ingannati, ma anche corruzione di dipendenti aziendali e utilizzo di database riservati. Il gruppo estorceva denaro per la cancellazione di informazioni da siti pubblici gestiti direttamente.

L’episodio chiave ha riguardato la violazione di un portale internet ritenuto appartenente alla Drug Enforcement Administration (DEA), come confermato dal giornalista Brian Krebs.

Il sistema conteneva dati provenienti da 16 database federali, inclusi rapporti su sequestri di droga e denaro contante. Gli hacker hanno utilizzato le credenziali rubate dei dipendenti per accedere. Una volta ottenuto l’accesso, hanno scaricato e iniziato a utilizzare dati sensibili a fini di estorsione.

L'articolo ViLE, il gruppo che estorceva denaro dopo aver bucato i database federali USA proviene da il blog della sicurezza informatica.

Dear Friend of Press Freedom,

It’s the 80th day that Rümeysa Öztürk is facing deportation by the United States government for writing an op-ed it didn’t like. Meanwhile, aggression from law enforcement at protests in California have landed journalists in the hospital. Read on for more press freedom news.

Journalists under attack in LA

Our U.S. Press Freedom Tracker has been hard at work documenting the growing list of attacks on journalists — from shootings with crowd-control munitions to detainments to unlawful searches.

It’s a situation that is likely to get worse and spread to other cities, with local law enforcement emboldened by the administration’s rhetoric and federal agents being haphazardly thrown into situations they’re not trained to handle.

We worked with partner organizations in California to send letters to the Department of Homeland Security, Los Angeles law enforcement agencies, the Marines and National Guard informing them of their obligations under the First Amendment, and in the case of the local authorities, California law.

Of course, strongly worded letters are not nearly enough for situations like these, and there’s plenty more work to do. But in the meantime, we’re not going to stay silent. Read the letters here, here and here.

Superstar lawyers join our effort to stop Paramount settlement

As reported in the Los Angeles Times, we’ve got a legal all-star team behind our effort to stop Paramount Global from capitulating to President Donald Trump by settling his frivolous lawsuit over an edited “60 Minutes” interview with then Vice President Kamala Harris.

Abbe Lowell, a highly respected litigator who has handled countless high-profile cases, Norman Eisen, a former ambassador to the Czech Republic and White House ethics advisor and their respective teams sent a formal demand letter to Paramount’s directors on our behalf outlining our plans to file a shareholder derivative suit if Paramount tanks its reputation and furthers America’s democratic backslide by caving.

This is an expensive endeavor, and we don’t get a dime if we win — whatever we recover from rogue Paramount directors and officers goes back to Paramount. Read more here and support us if you can.

FPF takes State Department to court over Öztürk secrecy

Freedom of the Press Foundation (FPF) is taking the government to court over its refusal to disclose information about the arrest of Tufts graduate student Rümeysa Öztürk for exercising her constitutionally protected right to coauthor an op-ed the government didn’t like.

FPF, represented by Loevy and Loevy, filed a Freedom of Information Act lawsuit against the State Department in the District Court for the District of Columbia to force the release of two documents that will shed light on the government’s targeting of Öztürk. Read more here.

Documenting 10 years of Trump’s anti-press social media tirades

61,989. That’s how many social media posts by President Donald Trump over the past decade Tracker journalist Stephanie Sugars has single-handedly reviewed (at least as of yesterday).

Monday will mark 10 years since Trump famously descended a golden escalator at New York City’s Trump Tower in 2015 and launched his first winning bid for the Oval Office. The Tracker is marking the occasion by launching its Trump Anti-Press Social Media Tracker, a comprehensive database of Trump’s attacks on the press on Truth Social, X and elsewhere.

Read former Voice of America press freedom reporter Liam Scott’s article about Sugars and the database here.

What we’re reading

Supreme Court press corps asks chief justice to livestream court’s opinions (NPR). There’s simply no good reason for the Supreme Court to refuse to livestream its opinion announcements.

Woman arrested after interview by St. Paul journalist (Monitor). Federal authorities must promptly explain both their basis for arresting Isabel Lopez and how they knew where and when she’d be talking to reporters. Surveilling journalists is unacceptable.

Lindsey Graham thinks it should be illegal to identify ICE agents (Techdirt). It’s bad enough to ban identifying ICE agents, but notice how Graham slips in “other federal law enforcement officers involved in covert operations.” It’s part of a pro-secret police movement. And it’s bipartisan. Ask the taxpayers of LA.

Condemning SFPD’s detention of Daily Cal staffers and suppression of student journalism (The Daily Californian). Detaining journalists, even for a minute, prevents them from covering events of public concern, and violates their rights. The San Francisco Police Department and other police departments around the country need a crash course on the First Amendment.

DeSantis administration blasted for ‘chilling’ Florida press with cease and desist letter (Naples Daily News). Florida Gov. Ron Desantis is baselessly accusing the press of “coercing” people to say negative things about his wife’s initiatives. We assure you that no one is coercing us to say that Ron DeSantis is an anti-speech, wannabe authoritarian.

Small-town newspapers are dying because no one wants to run them (Columbia Journalism Review). Succession planning doesn’t usually make the list when people talk about the challenges facing the press, but Liam Scott explores the consequences of local newspaper publishers dying and retiring with no one there to take over.

freedom.press/issues/journalis…

When a wrist mounted keyboard floated past in the Hackaday feed, a mental image surfaced, perhaps something like a Blackberry keyboard mounted on a wrist cuff, maybe with some kind of display. It’s impressive indeed then to open the link and see [AdamLeBlanc]’s Schist01. It’s a wrist mounted keyboard, but with its bracket curving in front of the had to support a custom ergonomic chording keyboard, it’s definitely a break from the norm.

The wrist mount has clearly taken a lot of thought, and despite looking something like the arm of a Star Trek Borg, appears comfortable. It’s extremely adjustable, and can be demounted into several different parts. Meanwhile the keyboard itself has been formed to his hand by a trial and error process involving keycaps and a clay model. there’s even a thumb-operable touchpad.

We like this peripheral a lot, for the huge attention to detail that has gone into its design, for its boldness, and because we can’t help seeing ourselves using it as the input device for a futuristic head-mounted display. For now though we don’t have any futuristic silver clothing in the wardrobe, so that will have to wait. If you’d like to see more, there’s a video.

youtube.com/embed/Eklg7CKs57A?…

Thanks [Shotgun Moose] for the tip.

hackaday.com/2025/06/13/taking…

In the Blackberry-keyboard-based project lineage story last week, I covered how a series of open-source projects turned into Beepy, a cool Linux PDA with a lively community. To me, it’s yet another demonstration of power that open-source holds, and more importantly, it shows how even a small pet project of yours could cause big moves in the hardware world, provided you publish it – just ask [JoeN], [WoodWorkeR] and [arturo182].

The journey didn’t end there. For all its benefits, Beepy had some flaws to take care of, some board-killing flaws, even. The 5 V boost regulator was never intended for 4.7 V input it gets when charger is connected, and would occasionally cook itself. A charging current resistor was undersized, leading people to either bodge resistors onto their Beepy boards, or have their battery charge for 30 hours until full. A power path diode was undersized, too, and has burned out on more than a few devices. Also, Beepy’s feature package left things to be desired.

Beepy never made it beyond v1. If I had to guess, partially because of BB Q20 keyboard sourcing troubles, but also definitely some sort of loss of interest. Which is a shame, as the plans v1.5 of the hardware were pretty exciting. In the meantime, other players decided to take up the mantle – here’s a tale of three projects.

Improved, Colorful, Closed

I like to talk about all sides of open-source hardware, good and bad. We’ll start with the bad here. Sometimes, you’ll publish a project under an open license that requires other people to share their work if it’s based on your project files. Then, someone takes your files, makes none to minimal changes, closes the sources, maybe even completely removes the attribution, and starts selling them. That’s the story of Colorberry.
Left: OG Beepy, right: Colorberry; spot 10 differences. If one of them is “stripped of all attribution”, you get bonus points.
It was one of the first Beepy derivatives — seemingly fixing two of the three Beepy bugs, and adding support for a color display from JDI. Unfortunately, it also removed some important elements: namely the attribution to the Beepy on product or project pages – and closed-sourced the files.

Beepy’s PCB is licensed under a reciprocal (copyleft) license, which means that derivative product designers are supposed to share any changes they make. Without access to the source, it’s difficult to confirm that Colorberry really fixed the upstream Beepy bugs. It also makes it harder to diagnose and repair the hardware, and limits the chances the Colorberry would live on should its creator step away from the project.

Unfortunately, the problems don’t stop there. The code to drive the color screen is heavily based upon a driver produced by people in the Beepy community. Like the Beepy hardware, the license for the driver (GPL) requires that changes made to the code be made public. But when Alex, the Colorberry developer, was asked about publishing the code for this driver, he responded that it would happen “once the driver is ready.” A year later, the new story is apparently that he will release the sources once his personal stock of color screens runs out.

Because the driver is only published as (non-stripped) binaries on GitHub, it needs to be recompiled and republished by Alex with every Linux kernel update or distro that Colorberry could be used with. It’s also markedly harder to install (to the point people had to concoct multi-step install scripts), and I have it on good authority that the driver contains a bug that will actually reduce the lifetime of the display. But without the source for the driver, the community can’t fix it.
I confirmed this later on, having looked at the binary files myself – indeed, even the typos from someone else’s open-source driver are still present in Colorberry driver code.
From what I’ve seen, the Beepy open-source design has been a crucial factor for its community to flourish and keep thriving even two years later. Colorberry’s puzzling closed-source decisions just don’t add up to the same value, and I gather that’s a big part of why the project didn’t gain more traction.

The Colorberry isn’t the only Beepy clone to keep the hardware source to itself. The PiBerry from CarbonComputers doesn’t fix the bugs from the original handheld, unfortunately, but it does bring a higher resolution color display to the party. It also doesn’t try to erase its lineage, with both the PCB silkscreen and the documentation referencing the fact that it’s based on the Beepy. Even still, the board design files aren’t included in the PiBerry repository.

What’s interesting in this case is that CarbonComputers later made a newer PiBerry version in same form-factor, aimed at assembly from more off-the-shelf components, and that version does have its KiCad files published. I’m willing to give the creators the benefit of the doubt here, and say that not including the source files for the previous versions of the hardware might simply be an omission on their part and not intentional.

These two weren’t the only projects coming to life because of Beepy’s success – at times, if you get someone inspired enough with a project of yours, they could end up building an entire lineup of gadgets. Such is the case of Hackberry Pi, a project coming from a hacker named Zitao.

The Hackberry Family

Ever wanted the power of a Pi 5 in a portable package? That’s where you reach for the Hackberry Pi. The CM5 version is way sleeker than this one, I gotta say.
You might’ve seen the Hackberry Pi around – it’s a Beepy-like device with a 720×720 DPI screen derived from Adafruit’s Hyperpixel design and a Q20 keyboard. A number of parts in the first Pi Zero-based versions of the Hackberry Pi were visibly derived from the Beepy design. However, at least the later versions have been re-drawn from scratch in EasyEDA, with a number of diverging design paths, and Zitao has been prolific in building newer and generally better versions of the platform.

From a Pi Zero-based version with Nokia batteries, to Pi 5-based device powered by 18650s, the Hackberry has gone through quite a journey. Just a couple days ago from the time of this writing, the Compute Module-based version of the Hackberry Pi has become available, and it’s been selling like hotcakes.

Zitao’s hardware is inspiring in a few ways. For instance, the ways in which these devices avoid driver installation requirements, with keyboard connected over USB instead of I2C, powerbank chips with LED battery level display instead of the Beepy’s RP2040, and it goes even to the point of soldering a small Bluetooth receiver module onto the board to drive the onboard speakers from the Pi running the show. It’s a kludge, but at the same time, it’s hard to argue with things that work well in practice!

Hackberry Pi devices are also closed source, but at least schematics have been made available. This is good enough to spot most bugs, and those schematics have already been useful for people pointing out poor design decisions in the first versions. Of course, it’s still against the spirit of open-source and in particular the project that made Hackberry Pi possible in the first place – but at least it’s a step in the right direction.

Our Radically Open Beepy Clone

As you might have guessed, I don’t like closed-source devices. In particular I dislike devices that benefit from an open-source ecosystem and then burn the goodwill provided, as if to sterilize and salt the land that would otherwise serve other projects in the future.
Two v1 Blepis units: one assembled with a Sharp display, another with a cheaper color SPI one.
Over the last half a year, I’ve had the privilege of working on the Blepis, a Beepy successor built by a hacker collective I’m a part of, called HackMods. We’ve designed, planned out, and assembled the first versions of these boards together, with the goal of having a fleet of Linux PDAs.

Made by hackers for hackers, it’s an experiment in just how far you can push the Beepy design, and we’re keeping things as open-source as we found them – arguably even more so! In particular, even our case design is in FreeCAD and open-source, with .FCstd files included.

First major improvement we made was in screen support. Sharp Memory screens can be expensive and are often out of stock for months, and JDI screens are even more expensive than that, often the only options are overpriced eBay listings. This is somewhat okay for a one-off, but it is very sub-optimal if you’re building a fleet of a dozen hacker PDAs for you and your friends.

That’s why we’ve added support for the commonly available 3.2″ 320×240 18-pin SPI color screens in addition to Sharp and JDI screens. We even have touchscreen controller support for the 18-pin panels that come with a touch layer, and support backlight on displays which have it. Of course, the known Beepy bugs are fixed as well. Our 5 V boost is operating within spec, and we have a switch-mode battery charger expected to give off barely any heat at all while providing a fair bit of charging current.

The PCB, done mainly by [LinaLinn] and me, with others’ contributing to it in various ways. It would probably be easier to talk about what we didn’t add. Thankfully, for those things, we have an expansion connector!What else? Just for a start, we added an RTC, a vibromotor driver, and an onboard buzzer, not to mention things like QWIIC connectors for I2C and USB.

The Beepy didn’t have any onboard USB peripherals – you were expected to make use of the Pi Zero’s microUSB port. But we’ve added a whole USB ecosystem onto all the free space on the board – including a microSD reader, a slanted USB-C slot letting you connect a small USB-C 3.5 mm dongle soundcard for music playback (or other devices), and a USB hub chip to tie it all together. Apart from that, we support host mode on the bottom “charging” USB-C port, too – complete with 5 V power output.

Some of these features, like power output on the main USB-C port, are not supported by the firmware yet, But we’ve gotten pretty familiar with Beepy firmware while building v1, so, adding firmware support for those features is not expected to be that complicated.

Our expansion connector is also unparalleled when it comes to interfaces we expose. A single-row 23-pin header has 3.3 V, 5 V and VBAT power rails with over-current and backflow protection, plus I2C, SPI, UART, SDIO, PWM, and I2S, all ESD-protected.

We’ve already had a LoRa expansion module contributed by someone from the Beepy community, and one of our members has designed a DECT board. We plan on doing doing boards aimed at general-purpose hacking & BIOS chip flashing soon. If you ever wanted a PDA with a powerful expansion header for hardware hacking purposes, this is the design for you.

The Gift Of Giving Back

If you’re looking for a Linux PDA board, I hope you can appreciate the Blepis hardware design we bring to you, only possible because of a string of open-source projects before it. Our design files and driver/firmware sources are all on GitHub and GitLab, with a summary available on [Michael]’s BBKB ecosystem website.

Blepis is meant to work with JLCPCB PCBA, and we have a GitLab integration for exporting the project files – all the JLC part numbers are input into the schematics, so just upload the files and get a batch of motherboards delivered to your doorstep. To complete it, get a Pi Zero, a battery, a Blackberry Q20 keyboard, a display out of the list of supported ones, print the shell (v2-compatible shell coming soon), and off you go.

Seeing entirely new projects happen, each cooler and more advanced than the previous one, all because people kept publishing their code and PCB files, and then, getting to build a dream device for me and my friends thanks to someone else’s work – these kinds of experiences are what radicalized me in favour of being fervently pro-open-source. I see open-source philosophy live and thrive through dreams of hackers and barrels of viral licenses, through publishing despite imperfections, and building off each other’s dreams to turn the tide of tomorrow. I hope you get to experience it, too.

hackaday.com/2025/06/13/attack…

When home computers first appeared, disk drives were an expensive rarity. Consumers weren’t likely to be interested in punch cards or paper tape, but most people did have consumer-grade audio cassette recorders. There were a few attempts at storing data on tapes, which, in theory, is simple enough. But, practically, cheap audio recorders are far from perfect, which can complicate the situation.

A conference in Kansas City settled on a standard design, and the “Kansas City standard” tape format appeared. In a recent video, [Igor Brichkov] attempts to work with the format using 555s and op amps — the same way computers back in the day might have done it. Check out the video below to learn more.

These days, it would be dead simple to digitize audio and process it to recover data. The 1970s were a different time. The KC standard used frequency shift method with 2.4 kHz tones standing in for ones, and 1.2 kHz tones were zeros. The bit length was equal (at 300 baud), so a one had 8 cycles and a zero had 4 cycles. There were other mundane details like a start bit, a minimum stop bit, and the fact that the least significant bit was first.

The real world makes these things iffy. Stretched tape, varying motor speeds, and tape dropouts can all change things. The format makes it possible to detect the tones and then feed the output to a UART that you might use for a serial port.

There were many schemes. The one in the video uses an op-amp to square up the signal to a digital output. The digital pulses feed to a pair of 555s made to re-trigger during fast input trains but not during slower input trains. If that doesn’t make sense, watch the video!

The KC standard shows up all over the place. We’ve even used it to hide secret messages in our podcast.

youtube.com/embed/5X709smX2JY?…

hackaday.com/2025/06/13/casset…

Facebook and Yandex have been caught performing user-hostile tracking. This sort of makes today just another Friday, but this is a bit special. This time, it’s Local Mess. OK, it’s an attack with a dorky name, but very clever. The short explanation is that web sites can open connections to localhost. And on Android, apps can be listening to those ports, allowing web pages to talk to apps.

That may not sound too terrible, but there’s a couple things to be aware of. First, Android (and iOS) apps are sandboxed — intentionally making it difficult for one app to talk to another, except in ways approved by the OS maker. The browser is similarly sandboxed away from the apps. This is a security boundary, but it is especially an important security boundary when the user is in incognito mode.

The tracking Pixel is important to explain here. This is a snippet of code, that puts an invisible image on a website, and as a result allows the tracker to run JavaScript in your browser in the context of that site. Facebook is famous for this, but is not the only advertising service that tracks users in this way. If you’ve searched for an item on one site, and then suddenly been bombarded with ads for that item on other sites, you’ve been tracked by the pixel.

This is most useful when a user is logged in, but on a mobile device, the user is much more likely to be logged in on an app and not the browser. The constant pressure for more and better data led to a novel and completely unethical solution. On Android, applications with permission to access the Internet can listen on localhost (127.0.0.1) on unprivileged ports, those above 1024.

Facebook abused this quirk by opening a WebRTC connection to localhost, to one of the ports the Facebook app was listening on. This triggers an SDP connection to localhost, which starts by sending a STUN packet, a UDP tool for NAT traversal. Packed into that STUN packet is the contents of a Facebook Cookie, which the Facebook app happily forwards up to Facebook. The browser also sends that cookie to Facebook when loading the pixel, and boom Facebook knows what website you’re on. Even if you’re not logged in, or incognito mode is turned on.

Yandex has been doing something similar since 2017, though with a different, simpler mechanism. Rather than call localhost directly, Yandex just sets aside yandexmetrica.com for this purpose, with the domain pointing to 127.0.0.1. This was just used to open an HTTP connection to the native Yandex apps, which passed the data up to Yandex over HTTPS. Meta apps were first seen using this trick in September 2024, though it’s very possible it was in use earlier.

Both companies have ceased since this report was released. What’s interesting is that this is a flagrant violation of GDPR and CCPA, and will likely lead to record-setting fines, at least for Facebook.

What’s your Number?

An experiment in which Google sites still worked with JavaScript disabled led to a fun discovery about how to sidestep rate limiting and find any Google user’s phone number. Google has deployed defensive solutions to prevent attackers from abusing endpoints like accounts.google.com/signing/usernamerecovery. That particular endpoint still works without JS, but also still detects more than a few attempts, and throws the captcha at anyone trying to brute-force it.

This is intended to work by JS in your browser performing a minor proof-of-work calculation, and then sends in a bgRequest token. On the no-JavaScript version of the site, that field instead was set to js_disabled. What happens if you simply take the valid token, and stuff it into your request? Profit! This unintended combination bypassed rate-limiting, and means a phone number was trivially discoverable from just a user’s first and last names. It was mitigated in just over a month, and [brutecat] earned a nice $5000 for the effort.

Catching Reflections

There’s a classic Active Directory attack, the reflection attack, where you can trick a server into sending you an authentication, and then deliver that authentication data directly back to the origin server. Back before 2008, this actually worked on AD servers. The crew at RedTeam Pentesting brought this attack back in the form of doing it with Kerberos.

It’s not a trivial attack, and just forcing a remote server to open an SMB connection to a location the attack controls is an impressive vulnerability. The trick is a hostname that includes the target name and a base64 encoded CREDENTIAL_TARGET_INFORMATIONW all inside the attacker’s valid hostname. This confuses the remote, triggering it to act as if it’s authenticating to itself. Forcing a Kerberos authentication instead of NTLM completes the attacker magic, though there’s one more mystery at play.

When the attack starts, the attacker has a low-privileged computer account. When it finishes, the access is at SYSTEM level on the target. It’s unclear exactly why, though the researchers theorize that a mitigation intended to prevent almost exactly this privilege escalation is the cause.

X And the Juicebox

X has rolled out a new end to end encrypted chat solution, XChat. It’s intended to be a significant upgrade from the previous iteration, but not everyone is impressed. Truly end to end encryption is extremely hard to roll out at scale, among other reasons, because users are terrible at managing cryptography keys. The solution generally is for the service provider to store the keys instead. But what is the point of end-to-end encryption when the company holds the keys? While there isn’t a complete solution for this problem, There is a very clever mitigation: Juicebox.

Juicebox lets users set a short PIN, uses that in the generation of the actual encryption key, breaks the key into parts to be held at different servers, and then promise to erase the key if the PIN is guessed incorrectly too many times. This is the solution X is using. Sounds great, right? There are two gotchas in that description. The first is the different servers: That’s only useful if those servers aren’t all run by the same company. And second, the promise to delete the key. That’s not cryptographically guaranteed.

There is some indication that X is running a pair of Hardware Security Modules (HSMs) as part of their Juicebox system, which significantly helps with both of those issues, but there just isn’t enough transparency into the system yet. For the time being, the consensus is that Signal is still the safest platform to use.

Bits and Bytes

We’re a bit light on Bits this week, so you’ll have to get by with the report that Secure Boot attacks are publicly available. It’s a firmware update tool from DT Research, and is signed by Microsoft’s UEFI keys. This tool contains a vulnerability that allows breaking out of it’s intended use, and running arbitrary code. This one has been patched, but there’s a second, similar problem in a Microsoft-signed IGEL kernel image, that allows running an arbitrary rootfs. This isn’t particularly a problem for us regular users, but the constant stream of compromised, signed UEFI boot images doesn’t bode well for the long term success of Secure Boot as a security measure.

hackaday.com/2025/06/13/this-w…

Meta ha intentato una causa contro Joy Timeline HK Limited, con sede a Hong Kong, accusandola di aver distribuito in massa annunci su Facebook e Instagram per un’app che utilizza l’intelligenza artificiale per creare immagini di nudo senza il consenso degli utenti. La causa sostiene che Joy Timeline fosse dietro Crush AI, un servizio pubblicizzato come uno strumento in grado di “strappare i vestiti” da qualsiasi foto.

Decine di migliaia di annunci pubblicitari che promuovevano queste offerte sono stati distribuiti, nonostante Meta li abbia regolarmente rimossi, chiudendo pagine e account e bloccando domini che potevano essere utilizzati per accedere alle app. Secondo la causa, l’azienda ha intrapreso ripetuti provvedimenti contro Joy Timeline dal 2023, ma l’azienda ha continuato a pubblicare annunci NSFW che violavano le policy della piattaforma.

La causa sottolinea che Joy Timeline ha sistematicamente aggirato i divieti creando nuovi account aziendali e ripubblicando annunci simili. Meta insiste sul fatto che, senza l’intervento del tribunale, l’azienda continuerà ad agire in violazione delle sue regole. Entro febbraio 2025, più di 135 pagine Facebook e almeno 170 account aziendali distribuivano circa 87.000 annunci che promuovevano app di “spogliarello”, secondo i documenti.

Tra gli esempi citati nella causa figura uno di questi annunci, che mostra una donna in top nero e pantaloncini, con l’immagine divisa in due parti: a sinistra, vestita, con la scritta “NSFW”, e a destra, senza vestiti, con le didascalie “TOGLIERE IL REGGISENO” e “TOGLIERE I PANTALONI”. Gli annunci includevano inviti a caricare una foto per “spogliarsi in un minuto” o “creare un video di ballo”.

Meta afferma di considerare tali abusi una seria minaccia e di volerli contrastare attivamente. Oltre alla causa, l’azienda ha annunciato nuove misure per limitare la diffusione di tali servizi. Meta utilizza inoltre una tecnologia proprietaria per identificare tali annunci, anche se non contengono immagini di nudo dirette.

Utilizza un sistema di abbinamento per identificare rapidamente cloni e nuovi tentativi di inganno. L’azienda afferma che continuerà a ricorrere a misure legali e di altro tipo per limitare la diffusione di servizi di intelligenza artificiale che sfruttano e violano l’etica.

L'articolo 87.000 annunci per un’APP che sveste le persone. Meta: Rivestiteli tutti! proviene da il blog della sicurezza informatica.

Apple ha corretto una vulnerabilità critica, utilizzata per sferrare attacchi Zero Click contro giornalisti in Europa. L’errore permetteva di infettare i dispositivi senza l’interazione dell’utente: era sufficiente ricevere un messaggio appositamente preparato tramite iCloud Link. I dettagli dell’attacco, i suoi meccanismi e le sue conseguenze sono stati svelati dagli specialisti di Citizen Lab, che hanno condotto un’indagine forense sulle conseguenze di attacchi reali.

La vulnerabilità, identificata come CVE-2025-43200, è stata risolta il 10 febbraio 2025, negli aggiornamenti iOS 18.3.1 . support.apple.com/en-us/122174… , iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, watchOS 11.3.1 e visionOS 2.3.1. Secondo Apple, il problema è stato causato da un errore logico nell’elaborazione di foto o video inviati tramite link iCloud. Per risolverlo, l’azienda ha implementato controlli aggiuntivi.

Apple ha confermato ufficialmente che la vulnerabilità è stata sfruttata in un “attacco altamente sofisticato” contro individui specifici. Sebbene i dettagli dell’attacco in sé non siano stati divulgati nella notifica, l’analisi di Citizen Lab ha dimostrato che la falla è stata sfruttata per infettare gli iPhone di due giornalisti.

I dispositivi hackerati erano dotati di Graphite, uno strumento di sorveglianza avanzato sviluppato dall’azienda israeliana Paragon. Questo modulo spyware consente l’accesso remoto a messaggi, e-mail, microfono, fotocamera e posizione del dispositivo. Il suo utilizzo è solitamente limitato alle agenzie governative ed è ufficialmente considerato uno strumento per combattere la criminalità e le minacce alla sicurezza nazionale.

Citizen Lab ha scoperto che entrambi i giornalisti sono stati infettati dallo stesso account Apple, denominato “ATTACKER1“, il che indica che entrambi gli attacchi provenivano dallo stesso client Paragon. Le notifiche di Apple relative agli attacchi spyware sono state inviate alle vittime il 29 aprile 2025. Il sistema di allerta di Apple, in vigore dal 2021, avvisa gli utenti della potenziale esposizione a operatori governativi, ma non garantisce un’infezione effettiva.

Ciò che è ancora più allarmante è che Apple ha risolto contemporaneamente un’altra vulnerabilità, il CVE-2025-24200, anch’essa sfruttata in attacchi attivi. L’azienda ha segnalato questo bug solo qualche tempo dopo, senza specificare il motivo del ritardo. L’incidente è strettamente legato a un altro scandalo scoppiato a gennaio, quando Meta ha denunciato che Graphite era stato utilizzato per attaccare decine di utenti WhatsApp in tutto il mondo. Tra le vittime c’era anche il giornalista Francesco Cancellato, collega di Ciro Pellegrino. Questo porta il numero totale delle vittime note di Graphite a sette.

In mezzo alla controversia, la Commissione parlamentare per la sicurezza (COPASIR) ha pubblicato un rapporto in cui ha riconosciuto che le agenzie di intelligence italiane avevano effettivamente utilizzato Graphite per la sorveglianza mirata, ma solo nel rispetto della legge e dopo aver ottenuto tutte le autorizzazioni necessarie. Secondo la commissione, il programma era utilizzato per combattere il terrorismo, la criminalità organizzata, l’immigrazione clandestina, il contrabbando di carburante, lo spionaggio e i latitanti. Tuttavia, il dispositivo di Cancellato, come affermato nel documento, non era tra gli obiettivi, lasciando aperta la questione della vera fonte della sorveglianza.

Il rapporto rivela anche il funzionamento interno di Graphite. Per utilizzare lo spyware, un operatore deve accedere con nome utente e password. Ogni sessione viene registrata su un server gestito dal client: è il client, non Paragon, a controllare l’archiviazione e l’accesso ai registri delle attività. Ciò significa che l’utente finale può utilizzare Graphite in completa autonomia, senza controllo o monitoraggio esterno.

Citizen Lab ha sottolineato ancora una volta che tali incidenti dimostrano quanto i giornalisti rimangano vulnerabili agli strumenti commerciali di sorveglianza digitale. La difficoltà di rilevamento, la mancanza di procedure trasparenti e la possibilità di infezioni senza contatto rendono tali attacchi particolarmente pericolosi. La situazione dimostra chiaramente quanto sia urgente rafforzare il controllo internazionale e la regolamentazione giuridica nel campo della sorveglianza digitale.

Nel frattempo, un nuovo vettore di minaccia si sta sviluppando nel cyberspazio. Insikt Group di Recorded Future ha rilevato una ripresa dell’attività di un altro spyware israeliano, Predator, creato da Intellexa/Cytrox. A seguito delle sanzioni statunitensi, gli sviluppatori hanno modificato la propria infrastruttura e sono tornati in azione. I ricercatori hanno identificato nuovi server di livello 1 che indicano infezioni in Mozambico, nonché un collegamento con l’azienda ceca FoxITech sro, precedentemente affiliata al consorzio Intellexa.

Predator è stato utilizzato in più di una dozzina di paesi negli ultimi due anni, tra cui Angola, Armenia, Egitto, Indonesia, Mongolia, Arabia Saudita e Filippine. Più della metà dei clienti noti del programma si trova in Africa. Gli analisti affermano che l’impennata di attività è dovuta all’elevata domanda nei paesi soggetti a restrizioni all’esportazione, nonché all’utilizzo di strutture aziendali complesse che rendono difficile rintracciare l’origine e l’utente finale.

Gli esperti sottolineano che l’emergere di nuove infezioni, parallelamente agli attacchi con Graphite, evidenzia la portata della minaccia. Dispositivi, dati e privacy possono essere monitorati senza notifiche, mandati o segnali evidenti. La sorveglianza digitale sta diventando uno strumento privo di feedback e di controllo esterno.

L'articolo Un altro Zeroclick per IPhone corretto. Ma il mercato degli Spyware è sempre più florido che mai proviene da il blog della sicurezza informatica.

The following was a letter submitted by an anonymous Pirate supporter using the pseudonym “Forward Thoughts”, sharing critiques of the gap between the rights and freedoms guaranteed by the U.S. Constitution and how they are often undermined in practice. This article is apart of the project “Message in a Bottle”, allowing supporters of the US Pirate Party to submit editorial articles to the United States Pirate Party website.

Not many people are educated on this matter, but there’s a difference between rights and freedoms. Rights are legal protection of entitlements in regards to ethical, social, or legal principles bestowed to a populace. Freedoms are the capability to believe, act, or think without inordinate deprivation focusing on freewill and autonomy.

Let’s talk about our good old rights. Made in your township, county, state, and in the case of our constitutional amends Washington D.C. Constitutional amendments, otherwise known as the Bill of Rights, are an example of rights you have.

Back in 1789 the US Constitution was conjured up to succeed the precursor to the Bill of Rights, which was called the Articles of Confederation. Difference between the US Constitution and the Articles of Confederation was the US Constitution was made for all states to abide by within the Union, emphasising on a sturdy centralized government while the Articles of Confederation was to confer autonomy to the states with an emphasis of there being amicable relations between the states.

Here in the USA we have constitutional amendments that are supposed to protect us against a tyrannical government. These rights include, but are not limited to, freedom of speech, fair trial, privacy, and right to bear arms (firearms).

Before America gained its independence from the British crown while under its colonial rule, our founding fathers included a statement in the Declaration of Independence that said “we hold these truths to be self-evident”.

Here’s something to think about: if these truths are self-evident, why do we need it written on a piece of paper by lawmakers in an ever ideological-shifting Congress subject to interpretation by Judges who again, shift from one ideology to another when they get impeached, pass away while in office, or retire?

Right to a fair and impartial trial is granted under the 6th amendment. Moreover, it entitles you the right to a speedy and jury trial.

Just because you have the right to a fair trial doesn’t mean you have the liberty to a fair trial. In other words, your rights are enshrined into law on a piece of paper in theory but not in practice.

For instance, 1969 U.S. Supreme Court case Frazier v. Cupp said the police can lie to you in an interrogation. That’s right, deception is not grounds for nullification of evidence in a criminal trial.

1986 U.S. Supreme Court case Lockhart v. McCree excludes objectors to the death penalty on juries in capital punishment cases.

1965 U.S. Supreme Court case Singer v. United States mandated jury trials in federal court unless given permission for a bench trial by the government.

2021 U.S. Supreme Court case Jones v. Mississippi rendered a finding of “permanent incorrigibility” in cases of sentencing minors to life imprisonment without the possibility of parole unnecessary.

1991 U.S. Supreme Court case Harmelin v. Michigan clarified that mandatory minimum sentences, even when excluding extenuating circumstances, don’t violate the 8th amendment.

1984 Pulley v. Harris determined courts aren’t required to compare death penalty eligible cases to that of other similar cases before meting out capital punishment to defendants.

Jurors in jury trials are mentally subjected to a litany of social, racial, ethnic, and mental biases clouding their judgement to deliver an impartial decision on deciding if a defendant or defendants are guilty or not guilty.

Anyone who understands the legal system knows it’s customary, a rite of passage if you will, to know about everyone’s Miranda rights stemming from the 1966 U.S. Supreme Court Miranda v. Arizona case that ruled evidence obtained, i.e. statements, without advising suspects of their rights cannot be used against them at a criminal trial.

Why would you need to be protected against self-incrimination? Surely it’s to prevent the government from coercing a confession out of the accused.

It’s not just made for that, it also stands in as a consolation for police officers who are trained in interrogation using what’s called the “Reid technique” ensuring the defendant makes a false confession.

Not only is that used as a statement of admittance at trial, the defendant may also get charged with perjury.

Would it be too much of a stretch to imagine if a cop uses deceptive tactics on a suspect on the street and/or the interrogation room they won’t lie on the witness stand during proceedings of a trial?

Prosecutors have unfettered powers for what charges can be brought up against a defendant, even if the charges don’t make sense to be brought up on to a defendant to begin with. A legal precedent in the court system.

Moreover, they’re allocated a well-endowed budget. More so than the defendant, thus tilting the legal playing field in their favor for the so-called “public” to win.

Lastly, prosecutors use this morally (though not legally) coercive strategy where they’ll overcharge a defendant on crimes in order for them to plead guilty to fewer and/or lesser criminal charges.

Judges tend to be vindictive. It’s not supposed to be this way, yet it is.

What I mean by vindictive is if you don’t plead guilty to a crime, you’re most likely gonna be “made an example out of” and sentenced to the maximum sentence allowed by statute.

In some cases, even flat-out pleading guilty can make Judges sentence you out of spite with zero consideration for severity of the crime or focus on rehabilitation, simply because no one can stop them from acting on feelings of lawfully despotism.

Cruel and usual punishment is protected under the 8th amendment. Ever wonder why we have the death penalty legal in the federal justice system and in some states across the USA?

After the U.S. Supreme Court ruled it as unconstitutional in 1972 in Furman v. Georgia, four years later in 1976 we saw it reinstated in Gregg v. Georgia.

What amendment was this decided under you may ask? The one protecting us against cruel and unusual punishment.

Compare this to other developed nations around the world, you’ll see they don’t have the death penalty, thus highlighting capital punishment as unusual.

1987 U.S. Supreme Court case Singer v. United States found capital punishment is fair game even if the defendant didn’t intend to cause a death in a felony murder case.

1987 U.S. Supreme Court case McCleskey v. Kemp disregards racial statistics on capital punishments.

2003 U.S. Supreme Court case Ewing v. California paved the way for the Golden State’s draconian 3-strikes law.

2006 U.S. Supreme Court case Oregon v. Guzek disregarded permitting defendants from submitting innocent-based evidence during a sentencing phase of trial.

2019 U.S. Supreme Court case Madison v. Alabama greenlights executions of those who didn’t remember committing a murder, i.e. dementia.

Protection against double jeopardy and self-incrimination, as well as protecting your right to have due process in the legal system, is protected under the 5th amendment.

In a sense, you’re innocent until proven guilty in a court of law.

Due process is futile when you have a bail system permitting courts to charge defendants bail to be released back into the community well before they’ve even been convicted of a crime of the nature brought forth against them by the state while awaiting their sentence.

Get this: courts have held that police can force you to unlock your cellphone if it has biometric (fingerprint and face scan) security.

2011 U.S. Supreme Court case Bobby v. Dixon contradicts Miranda v. Arizona in the way that police don’t have to tell you of your rights when you’re not in police custody.

2010 U.S. Supreme Court case Berghuis v. Thompkins spat in the face of Miranda v. Arizona by taking away your right to be silent.

What I’m trying to say is you need to explicitly verbalize your right to remain silent to invoke your right to remain silent.

When your partner chooses not to answer you about whether or not they want to have sex with you, that’s not consent towards intercourse. At that point it’d be sexual assault.

The 2nd amendment explicitly states “A well regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed.”

Meanwhile, people who use recreational drugs of any kind are statutorily prohibited by federal law from owning a firearm.

Granted, there’s been a federal case recently ruling in favor of a defendant charged with gun ownership while simultaneously being a user of marijuana and overturning their conviction at the time of this article being published.

To add insult to injury, any felonies on your record regardless if non-violent or violent is an automatic disqualifier from owning a gun.

If Uncle Sam wasn’t bad enough with unlawfully regulating firearms you should take a look at a handful of states.

California, Massachusetts, New Jersey, Hawaii, and New York are among the top 10 states for gun control in increments of high capacity bans, guns at protests prohibited, interview with local police chief for discretionary approval, fully-auto and assault weapon bans, and mandatory waiting periods for firearm purchases.

Freedom of speech in the 1st amendment is meant to protect you against unlawful curtailment of your right to say disparaging things about the government.

In addition, it gives you the right to practice any religion you see fit and to peacefully assemble (think protests).

Too bad the U.S. Supreme Court decided it didn’t retroactively apply in these cases.

1941 U.S. Supreme Court case Cox v. New Hampshire ruled that local and state governments can pass laws mandating permits for large gatherings of protests.

1969 U.S. Supreme Court case Shuttlesworth v. City of Birmingham gave way for townships and cities to deny permits to protest events if they deem it as a threat to public safety within their community.

2007 U.S. Supreme Court case Morse v. Frederick declared promoting illegal drug use was outside the protection of freedom of speech.

1988 U.S. Supreme Court Hazelwood School District v. Kuhlmeier held that student speech in a school-sponsored newspaper can be censored by the faculty.

2025 U.S. Supreme Court case TikTok, Inc. v. Garland eroded TikTok’s ability to fall under the dominion of a foreign company under the guise of “national security”.

Imagine this: the 1st amendment doesn’t just protect people from freedom of speech, it protects unions, super PACs, and corporations.

2010 U.S. Supreme Court case Citizens United v. FEC granted corporations, and super PACs (political action committees) and even unions the right to independently spend on politician and political issue-based campaigns.

Yes, you read that right! Super PACs, corporations, and unions have been recognized as being considered in the same category as people under the 1st amendment.

Right of privacy in the 4th amendment protects you against unlawful search and seizures without probable cause or a warrant.

However, you wouldn’t even think this for what I’m gonna explain to you.

1975 U.S. Supreme Court case United States v. Brignoni-Ponce has established warrantless searches within 100 miles of the border.

1976 U.S. Supreme Court case United States v. Martinez-Fuerte gave border patrol the okay to set up checkpoints within the border zone to crack down on illegal immigration.

That same year, Heien v. North Carolina ruled an officer who mistakens the law when conducting a traffic stop doesn’t violate the 4th amendment.

2009 U.S. Supreme Court Herring v. United States said police can search you and your property illegally over a mistake.

2013 U.S. Supreme Court case Maryland v. King ruled that buccal swabs are permissible as if it were fingerprinting.

1990 U.S. Supreme Court case Michigan Department of State Police v. Sitz ruled that police sobriety checkpoints are legal.

1984 U.S. Supreme Court case New Jersey v. T. L. O. constructed a path for school administrators to search students on school property without a warrant.

In the exact same year, Oliver v. United States sprouted up a legal doctrine known as the “open-field doctrine” where searches done in a field not immediately surrounding a private quarters does not violate the 4th amendment.

Safford United School District v. Redding, while declaring the broad search done on a pupil who at the time was a girl was unconstitutional, school administrators were granted legal immunity from conducting illegal searches.

Slavery was abolished thanks to the passing of the 13th amendment.

Sadly, our judicial branch partially eroded this freedom via court cases.

1918 U.S. Supreme Court case Arver v. United States, otherwise known as Selective Draft Law Cases, finds the selective services, or the draft for times of war, to be a constitutional government program.

Upon thorough examination of the 13th amendment you’ll notice slavery is illegal except for instances where a victim has been subjected to incarceration.

Because that loophole was added into the final version of the amendment, prison labor is a lucrative business to corporations to have modern day slave labor produce their products at miniscule wages where they’re often sold at exorbitant prices on markets.

Your scope of freedoms are at the mercy of our 3 branches of government.

Moreover, they’re subject to scrutiny at the state level too.

Do we really need lawmakers wearing suits and ties to determine what’s good and bad for us?

If we did, could we truly rely on them to grant us liberty for us to live out an average day-to-day life not impeding on the well-being and safety of another person?

Will corruption get in the way of how judges are influenced?

Can judges not allow ideologies to interfere with just decisions?

Is there a necessity for a centralized governmental power in regards to control over how free a person becomes before it encroaches on another person’s free will?

Should we have security and insurance to protect others while depriving freedoms to others?

Here’s a quote I came up with: “Societies managed by the inhabitants with direct action have the most freedom while societies managed by the lawmakers with police have the least freedom.”

uspirates.org/message-in-a-bot…

The weaponization of the federal government against its critics used to be a Republican Party talking point when President Joe Biden was in office. Now that President Donald Trump’s in charge, it’s become their playbook.

Journalists and nonprofits, including nonprofit newsrooms, are particularly vulnerable to governmental attacks. Federal Communications Commission Chair Brendan Carr, for instance, has turned the investigatory power of the agency against the press, while the Department of Justice is pursuing investigations into nonprofits connected to left-leaning causes.

We wanted to learn more about how federal agencies like the FCC, Internal Revenue Service, and Department of Justice are abusing their authority to target First Amendment rights, so we hosted a discussion with FCC Commissioner Anna Gomez and Ezra Reese, an expert in nonprofit tax law and political law from the Elias Law Group.

As Commissioner Gomez said at the outset of the event, “The First Amendment is, of course, a pillar of American democracy, and consumer access to independent, unbiased news and public information is being threatened by the government itself.” Gomez is so concerned about the Trump administration’s attacks on freedom of speech that she’s launched a “First Amendment Tour” to speak out against what she calls a campaign of censorship and control.

youtube.com/embed/7MPn-OIbGqI?…

With respect to the FCC, in particular, Gomez explained, “Our licensing authority is being weaponized to curtail the freedom of the press, and these actions set a dangerous precedent that undermines the freedom of the press and the trust in the FCC’s role as an impartial regulator.” Carr has revived, launched, or threatened a slew of baseless “investigations” into broadcasters and public media based on their First Amendment-protected activities.

As a result, Gomez said, broadcasters are being chilled. “I have heard from broadcasters who told me that they are asking their reporters to be careful about how they are reporting about this administration because they are so afraid of being dragged before the FCC,” she said.

Nonprofit organizations, including nonprofit newsrooms, are also feeling the chilling effect of investigations by the Department of Justice intended to silence critics of the administration. Reese described the DOJ’s targeting of nonprofit organizations as “terrifying,” citing investigations of environmental groups and Democratic fundraising outlets. One particular threat to nonprofits is the possibility of being designated a “terrorist” organization based on routine protest activity, Reese said.

In many instances discussed by Gomez and Reese, officials have hijacked vague legal standards to use them in ways that would threaten the First Amendment. The FCC, for instance, has brought investigations under its “news distortion” policy or sought to use its statutory language instructing it to license the airwaves in the public interest to go after news outlets it disfavors because of their coverage.

Gomez was highly critical of these moves, explaining, “The idea that the FCC would take enforcement action or revoke a broadcast license based on editorial decisions is antithetical to the First Amendment and the Communications Act, which prohibits the FCC from censorship.” As she succinctly put it, “The administration is conflating the public interest with its interests.”

Similarly, vague standards in criminal statutes or the tax code could also be used against nonprofits, including nonprofit news outlets, Reese warned. “The current law is very permissive to the federal government, either the president or using other agencies like the secretary of state declaring organizations to be terrorist organizations,” Reese said. “The standards are very loose.”

IRS standards that nonprofits rely on to guide their activities while maintaining their nonprofit status are also often “cobbled together” using administrative rulings by the IRS known as revenue rulings. These rulings, Reese said, “could easily be reversed.” For journalism nonprofits, in particular, Reese flagged that the precedents are “ancient” and do not address social media or shorter-form online journalism. While nonprofit news outlets have significant protections under tax law, Reese warned, “Any nonprofit organization should have some idea of what they’re going to do if the IRS or somebody else comes after them.”

In addition to being prepared, both Gomez and Reese emphasized the importance of speaking out in support of First Amendment rights. Reese cited the “power in shining a light,” noting that both journalists and individuals can bring attention to attacks but also to the organizations that are doing the right thing and fighting back. Similarly, Gomez said, “Sunshine is the best disinfectant, and we cannot allow this administration to trample all over the First Amendment in our democracy without speaking up.”

Gomez and Reese are right. The Trump administration’s attacks on the press and nonprofits are meant to cement government control by silencing dissenting voices. That’s why here at Freedom of the Press Foundation (FPF), we’ll continue to speak up against these abuses and encourage journalists and the public to do the same. Using our freedom of speech is our best and most powerful weapon for fighting back.

freedom.press/issues/federal-a…