fnix dev

Olá, estou usando o Twitter.

[Kruptos @KuptoKosmos]

🌐 Tor prend ses distances avec Mullvad à cause d’un don personnel via un co-fondateur à un parti suédois... Mais en parallèle, le projet a été conçu et financé pendant des décennies par des branches du gouvernement américain !

En 2025, Daniel Berntsson (co-fondateur et co-propriétaire de Mullvad) donne 5M SEK (520 k$) à l’Örebropartiet. Ce don représente environ 72% des revenus du parti cette année-là

Le parti prône notamment zéro immigration d’asile (hors cas très limités) et une remigration à grande échelle

Mullvad précise que c’est un don privé, que la société n’est pas impliquée, et que l’autre co-fondateur s’y oppose

Le 9 octobre 2026 Tor réagit...

Ils gardent la collaboration technique (Mullvad Browser = Tor Browser sans le réseau.. ça a amélioré la maintenabilité et l’auditabilité du code)

Mais ils mettent en pause le co-branding et clarifient le langage pour ne plus laisser croire à un alignement de valeurs

"Bien que Tor défende la liberté d’expression, tous les discours ne sont pas également compatibles avec notre mission. Nous nous opposons fermement aux propos qui menacent d’autres droits humains et libertés"

L’onion routing a été inventé dans les années 1990 au Naval Research Laboratory (US Navy) par Paul Syverson et ses collègues

Objectif initial : protéger les communications des agents de renseignement américains

Chiffres (sources Tor + Form 990) :

- 2015 : 85% du budget venait du gouvernement US

- 2021-2022 : 53,5%

- 2023-2024 : encore 35% (2,56 M$ sur 7,3 M$) dont 2,12 M$ du State Department (Bureau of Democracy, Human Rights, and Labor)

Le Broadcasting Board of Governors (BBG, agence issue de la CIA qui gère Voice of America, Radio Free Europe, etc..) a versé environ 6,1 M$ à Tor entre 2007 et 2015 via l’Open Technology Fund

Les documents FOIA ont montré

2500 pages de correspondance :

Plans de déploiement de Tor dans des pays ciblés par Washington (Chine, Iran, Russie..)

Réunions et trainings avec CIA, NSA, FBI, DOJ et State Department

Rapports mensuels détaillés aux financeurs, et contrats avec obligations strictes

Il y a un contraste...

Un don personnel d’un co-fondateur de partenaire à un parti local suédois = distance idéologique et clarification de valeurs

Des millions de dollars récurrents, des origines militaires, des contrats et des réunions documentées avec des agences US de soft power et de sécurité = acceptés depuis le début

Bref... Le code est open source. C’est une vraie protection technique. Mais les priorités, les arbitrages et la dépendance financière restent des faits

Savoir d’où vient l’argent, et quelles paroles sont jugées "incompatibles" avec la mission fait partie de la souveraineté numérique 🔎

[It's FOSS @Itsfoss]

There will be no Linux Mint 23 release.

There will be no more Linux Mint xx.yy releases anymore.

Linux Mint is changing its version number as it switches to an yearly release cycle.

The next Mint release is Linux Mint 27 that will be released at the end of year 2026.

Next Mint release will be in December 27 and it will be Mint 28.

Basically, the year becomes the version number. Similar to what Samsung did with its Galaxy smartphone releases.

Do you like the new version numbering?

[Tuta @TutaPrivacy]

It's #NationalCyberSecurityAwarenessMonth 🌐🔒

To celebrate, we have asked our Tuta community 👥💬 what their favorite browsers, search engines, message and password apps are, and these are the results📊

What are your favorite privacy apps📱? Let us know in the comments 👇

#CyberSecurity #CyberSecMonth #TutaMail #Privacymatters

[The Hacker News @TheHackersNews]

⚠️ No login required. CVSS 10.0. Active exploitation.

Attackers are exploiting a Bricksforge WordPress flaw (CVE-2026-85097) that enables arbitrary PHP code execution through crafted file-upload metadata.

Patchstack observed attack activity from 63 IPs. Update to version 4.0.1.

Read - https://t.co/GMJnf0PB2u

[fnix dev @fnix_dev]

@Redot_Engine Oh, thanks. I will install and use it.

[Tuta @TutaPrivacy]

#DeGoogled Maps? Yes, it's possible. 📍🗺️

The Big Tech does not need to track your every step 👉 Use a Google Maps alternative instead. 

Find out which open source maps are available: https://t.co/oXKGWLLfxo

#GoogleMaps #GoogleMapsAlternative

[It's FOSS @Itsfoss]

Gentoo Linux is asking for new infrastructure sponsors after multiple long-time contributors quietly pulled out.

No names have been confirmed yet. But the timing is hard to ignore: just weeks after DigitalOcean ended its Open Source Credits program, cutting free cloud infrastructure for projects like Node.js and Pidgin without a public announcement.

Are we watching the early signs of an open source infrastructure crisis?

Here is what has changed. AI has sent demand for server capacity through the roof. GPUs and data center space that used to be relatively affordable are now being fought over by cloud providers, AI startups, and hyperscalers.

The cost of running infrastructure has climbed sharply, and the generous "free tier for open source" that companies offered in better times is now a line item that finance teams are scrutinizing.

Giving away server capacity when it cost almost nothing was an easy PR win. Giving it away when every rack is spoken for and margins are under pressure is a different calculation.

Open source projects have always depended on this corporate goodwill. Gentoo, one of the oldest and most respected Linux distributions, is now scrambling for sponsors.

The question is how many other projects are in the same position but have not said anything yet.

[Kruptos @KuptoKosmos]

🇨🇦📱 Signal n'a pas l'intention"discuter" avec le Canada... Si Ottawa exige les clés, Signal ferme !

En ce début octobre, Udbhav Tiwari le vice-président de Signal l’a définitivement confirmé à des sénateurs

Le projet C-22 Lawful Access Act peut :

> Ordonner les clés de chiffrement
> Forcer la collecte de métadonnées au-delà du minimum
> Les stocker 6 mois
> Exiger une version plus faible du produit

Signal dit que ça casse l’app et c'est évident

Le choix est simple selon Tiwari :

> Servir le Canada avec le même chiffrement que partout

> Ou une version trouée

Ils prennent la première... Et s’il faut couper le pays, ils coupent !

Ce n’est pas une menace pour un coup de com... C’est le modèle, point

Pas de backdoor locale
Pas de Signal canadien

Soit le protocole tient
Soit Signal n’est plus là

Bref... Le chiffrement ne se négocie pas par pays. Il se casse, ou il reste et les acteurs des alternatives fiables comme @signalapp et @GrapheneOS n'hésitent pas à partir des pays réclamants des backdoor... Soutien et Merci pour votre travail 👏

[fnix dev @fnix_dev]

@Pirat_Nation @screenshotbot_ screenshot this

[It's FOSS @Itsfoss]

Happy 43rd Birthday, GNU!🎉

The GNU Project was founded by Richard Stallman on September 27, 1983, to bring free and open software to everyone. 💻🌐

[𝐇𝐚𝐦𝐳𝐚 | Networking Guy @Hamzaonchain]

📂 ETHICAL HACKING TOOLS
┃
┣ 📂 Reconnaissance
┃ ┣ 📂 Shodan
┃ ┣ 📂 theHarvester
┃ ┣ 📂 Maltego
┃ ┣ 📂 Amass
┃ ┣ 📂 Subfinder
┃ ┗ 📂 WHOIS
┃
┣ 📂 Scanning & Enumeration
┃ ┣ 📂 Nmap
┃ ┣ 📂 Masscan
┃ ┣ 📂 RustScan
┃ ┣ 📂 enum4linux
┃ ┣ 📂 SNMPwalk
┃ ┗ 📂 Netcat
┃
┣ 📂 Web Application Testing
┃ ┣ 📂 Burp Suite
┃ ┣ 📂 OWASP ZAP
┃ ┣ 📂 Nikto
┃ ┣ 📂 Gobuster
┃ ┣ 📂 ffuf
┃ ┗ 📂 Dirsearch
┃
┣ 📂 Exploitation
┃ ┣ 📂 Metasploit
┃ ┣ 📂 Searchsploit
┃ ┣ 📂 BeEF
┃ ┣ 📂 SQLmap
┃ ┣ 📂 Commix
┃ ┗ 📂 RouterSploit
┃
┣ 📂 Credential Attacks
┃ ┣ 📂 Hashcat
┃ ┣ 📂 John the Ripper
┃ ┣ 📂 Hydra
┃ ┣ 📂 Medusa
┃ ┣ 📂 CeWL
┃ ┗ 📂 Crunch
┃
┣ 📂 Wireless Security
┃ ┣ 📂 Aircrack-ng
┃ ┣ 📂 Kismet
┃ ┣ 📂 Wifite
┃ ┣ 📂 Bettercap
┃ ┣ 📂 Reaver
┃ ┗ 📂 hcxdumptool
┃
┣ 📂 Network Analysis
┃ ┣ 📂 Wireshark
┃ ┣ 📂 tcpdump
┃ ┣ 📂 Ettercap
┃ ┣ 📂 Bettercap
┃ ┣ 📂 TShark
┃ ┗ 📂 Scapy
┃
┣ 📂 Active Directory
┃ ┣ 📂 BloodHound
┃ ┣ 📂 NetExec
┃ ┣ 📂 Impacket
┃ ┣ 📂 Certipy
┃ ┣ 📂 Rubeus
┃ ┗ 📂 Mimikatz
┃
┣ 📂 Cloud Security
┃ ┣ 📂 ScoutSuite
┃ ┣ 📂 Prowler
┃ ┣ 📂 Pacu
┃ ┣ 📂 Trivy
┃ ┣ 📂 kube-hunter
┃ ┗ 📂 kube-bench
┃
┣ 📂 Reverse Engineering
┃ ┣ 📂 Ghidra
┃ ┣ 📂 IDA Free
┃ ┣ 📂 x64dbg
┃ ┣ 📂 Radare2
┃ ┣ 📂 Cutter
┃ ┗ 📂 Binary Ninja
┃
┣ 📂 OSINT
┃ ┣ 📂 SpiderFoot
┃ ┣ 📂 Sherlock
┃ ┣ 📂 Recon-ng
┃ ┣ 📂 PhoneInfoga
┃ ┣ 📂 GHunt
┃ ┗ 📂 Holehe
┃
┣ 📂 Containers & DevSecOps
┃ ┣ 📂 Trivy
┃ ┣ 📂 Dockle
┃ ┣ 📂 kube-bench
┃ ┣ 📂 kube-hunter
┃ ┣ 📂 Docker Bench
┃ ┗ 📂 Checkov
┃
┣ 📂 Reporting
┃ ┣ 📂 Dradis
┃ ┣ 📂 Ghostwriter
┃ ┣ 📂 Serpico
┃ ┣ 📂 CherryTree
┃ ┣ 📂 Obsidian
┃ ┗ 📂 Markdown
┃
┣ 📂 Practice Labs
┃ ┣ 📂 Kali Linux
┃ ┣ 📂 Parrot OS
┃ ┣ 📂 Hack The Box
┃ ┣ 📂 TryHackMe
┃ ┣ 📂 PortSwigger Academy
┃ ┗ 📂 VulnHub
┃
┗ 📂 Security Resources
┣ 📂 CyberChef
┣ 📂 Exploit-DB
┣ 📂 SecLists
┣ 📂 GTFOBins
┣ 📂 LOLBAS
┗ 📂 VirusTotal

[Baldly Rudy @baldlyrudy]

Qualcomm just made a major Linux commitment for Snapdragon X2.

-Official Linux Early Developer Preview
-Debian support targeted by end of 2026
-Ubuntu certification targeted for H1 2027
-Freedreno / Turnip / Rusticl GPU support
-Hexagon NPU support through FastRPC
-Upstream kernel + driver development
-HP, ASUS + HUMAIN planning Linux support in Q1 2027

This goes well beyond just getting Linux to boot.

[Qualcomm Developer @Qualcomm_Dev]

You asked. We listened.

The @Linux on @Snapdragon X2 Series Early Developer Preview is here. It's an early milestone, with support rolling out in phases, but developers can start exploring, testing, and providing feedback already today: https://t.co/Gfcdp1cqjw

Join our Discord and help shape the future of Linux on Snapdragon: https://t.co/vshrWqqKuz

[The Hacker News @TheHackersNews]

🚨 A public exploit now targets an unpatched Ubuntu 26.04 kernel flaw that can escape containers and gain root on the host.

The AF_UNIX bug is reachable through syscalls allowed by default Docker and Kubernetes seccomp profiles. No attacks are confirmed.

How it works: https://t.co/AsNPkMC4eR

[Smartphones sans Google (GAFAM) @Sans_Google]

F-Droid 2.0 is finally here.

After more than a year of work and 14 test releases, it’s the biggest update to the app in 10 years.

What’s new:
🔹completely redesigned interface
🔹better search
🔹more detailed categories
🔹new filters
🔹automatic updates
🔹easier app installation
🔹still no tracking

And yes, F-Droid still wants to help you escape the Play Store.

One small catch: the “panic” feature that could wipe apps isn’t back yet.

If you use F-Droid, have you already made the jump to 2.0?

https://t.co/WQoi6vl7QQ

#FDroid #FOSS #Android #OpenSource

[fnix dev @fnix_dev]

Não consigo acessar meu acesso de outro dispositivo, mesmo aceitando a solicitação no meu aparelho móvel.

@instagram

[International Cyber Digest @IntCyberDigest]

‼️ Google Search is now hiding where its results lead. Links point to google[.]com/goto?, followed by an opaque string only Google can resolve.

You can no longer inspect a destination before clicking it, or copy the address out of the page.

Every click now travels through Google first.

[Bob Pony @TheBobPony]

A new method for skipping the mandatory Microsoft Account login in Windows 11 Home Edition has been discovered... just simply click on the small Learn more hyperlink on the Microsoft Account login page.

[International Cyber Digest @IntCyberDigest]

Nightmare Eclipse, the person who has been dropping Windows zero-days, has finally decided to share his story. He's an ex-Microsoft employee, we had dinner together, and I've known him and his story for some time.

His real name is Abdelhamid Naceri. He's a very talented and intelligent individual, and he came across as someone who'd be a real professional to work with.

"If only I didn't pour my soul into that job with countless of stupid non sleep nights, i would have gotten over it..." - Naceri

He loved Microsoft.

I wouldn't say that what he did, releasing all those zero-days, was normal, but he felt he had no other option because of the injustice Microsoft did to him.

They fired him, and you can read the vague reason they gave in the email sent to him by the Vice President of Engineering at MSRC, below.

According to Abdel's account, VP Tom Gallagher met with him after the firing to tell him they were blacklisting him from Microsoft and writing him a bad reference so he'd never be able to get a job again.

Normally you'd think, well, big deal, just find another job, right? But Abdel doesn't have a European passport, and he was only a couple of months away from getting permanent EU residence.

So instead of granting him those couple of months, Microsoft fired him for a reason that, as far as we can tell, was never made clear, then fought him in court and offered him €55,000 plus a year's pay to drop the case.

All while Abdel was releasing zero-days.

Abdel continued suing Microsoft for unfair termination in Germany, a fight that has cost him over $200,000.

He says Microsoft refused to reveal any details about the security breach and went another direction.

If you are reading this, and you can offer him a LEGAL job, this is his e-mail: [email protected]