Micah Lee

Micah Lee also made Dangerzone [1] a tool to safely convert untrusted pdf files to safe-to-open pdf files, wrote the book Hacks, Leaks, and Revalations [2] and he made Tor-Browser-Launcher [3] and he's a respected investigative journalist: https://micahflee.com/ [1] https://dangerzone.rocks/ [2] https://hacksandleaks.com/ [3] https://github.com/torproject/torbrowser-launcher

From the other article which shared the email domains found in the heap. Sorry in advance for the poor formatting. --- Source: `https://micahflee.com/telemessage-customers-include-dc-police-andreese… ### I. Industry Breakdown *Financial Services (Dominant):* This is by far the most represented sector. It encompasses a wide array of sub-sectors: * *Investment Banking & Brokerage:* A large number of domains belong to global and regional investment banks, interdealer brokers, and brokerage firms. * Examples: `jefferies.com`, `morganstanley.com`, `cantor.com`, `tpicap.com`, `bgcg.com`, `rjobrien.com`, `clarksons.com` (shipping finance/brokerage) * *Asset & Investment Management:* Numerous firms managing diverse asset classes for institutional and private clients are present. * Examples: `kkr.com`, `aresmgmt.com`, `pimco.com`, `nuveen.com`, `franklintempleton.com`, `apg-am.com` * *Banking (Commercial & Private):* Major multinational and regional banks are included, covering commercial, private, and retail banking. * Examples: `jpmorgan.com`, `bbva.com`, `cibc.com`, `scotiabank.com` (and its numerous regional variations), `bradescobank.com`, `safra.com`, `standardbank.co.za`, `dbank.co.il` * *Wealth Management:* Firms specializing in wealth advisory for high-net-worth individuals are visible. * Examples: `gentrustwm.com`, `boltonglobal.com`, `rohrpwm.com` * *Cryptocurrency & Digital Assets:* A significant and growing…

Freedom of the Press Foundation (disclosure: I am an employee) ships grsecurity kernels for SecureDrop. You have to build them yourself, but it really isn't that hard to do. We're working on making this easier for everybody by publishing guides [0] to building your own grsecurity kernel, as well as developing an Ansible playbook to automate building hardened kernels [1]. This is all still a work in progress, but expect a blog post once what we have is more polished. A relatively easy-to-follow blog post was recently published that guides you through building a grsecurity kernel for a Debian desktop installation: [2]. grsecurity was operating a service last year that would allow you to request custom built kernels for a small price, although I can't find it now so it may have been taken offline. This is an ideal solution, and is actually better than packaging the kernels in an distribution's repository, because some of grsecurity's security features are more effective when everybody is running a unique kernel (e.g. RANDSTRUCT). Finally, the linux-hardening group is working on upstreaming select PaX features into the mainline kernel [3], including PAX_REFCOUNT, which is the protection that would've mitigated this particular vulnerability. [0]: https://gist.github.com/ageis/a91f36ca99c252291a00 [1]: https://github.com/freedomofpress/grsec/ [2]: https://micahflee.com/2016/01/debian-grsecurity/ [3]: http://lwn.net/Articles/668876/

This app wasn't even the safest, see here: ICEBlock handled my vulnerability report in the worst possible way | https://micahflee.com/iceblock-handled-my-vulnerability-report-in-the-…

TeleMessage is a prominent, infamous such product: https://micahflee.com/tm-sgnl-the-obscure-unofficial-signal-app-mike-w…

For reference here was his previous article https://micahflee.com/unfortunately-the-iceblock-app-is-activism-theat…

Giving an author 90 minutes of lead time before public negative press doesn’t count as responsible disclosure. Especially when that press doesn’t mention the specific security vulnerabilities you’re reporting to them. Here is a link to the blog post which accompanied the OP’s text: https://micahflee.com/unfortunately-the-iceblock-app-is-activism-theat… Is it reasonable to expect a maintainer to assume in good faith when the report is this unactionable?

Well, they're not even using Signal, but a wrapper that's less secure. https://micahflee.com/tm-sgnl-the-obscure-unofficial-signal-app-mike-w…

You can. The author made the source code of the app itself available: https://micahflee.com/heres-the-source-code-for-the-unofficial-signal-…

At least in the past there was no fine-grained option to backup other things like bookmarks without also giving google all of your wifi passwords: https://micahflee.com/2013/07/use-android-youre-probably-giving-google… The only way was turning on some enterprise mode most home routers don't have, I think because they didn't want to get sued for leaking company passwords.

It's very... problematic. And Yasha clearly displays a lack of knowledge (or is knowingly lying) by making the claim that the Tor Project is tipping of the US government to vulnerabilities. Here is why: https://blog.erratasec.com/2018/03/askrob-does-tor-let-government-peek… Some more Yasha stuff: https://micahflee.com/2014/12/fact-checking-pandos-smears-against-tor/

Micah Lee's blog – OnionShare 2.6 : https://micahflee.com/2022/10/new-censorship-circumvention-features-co… OnionShare 2.6 – Documentation : https://docs.onionshare.org/2.6/en/ OnionShare – GitHub : https://github.com/onionshare/onionshare OnionShare – Change Log (Text) : https://raw.githubusercontent.com/onionshare/onionshare/main/CHANGELOG…

“Important to note that nothing Wikileaks has published has ever had to be retracted. They've told the truth to the public about governments“ That isn’t true for their social media: https://micahflee.com/2019/01/lies-that-wikileaks-tells-you/

> Yasha Levine dug up (showing that Tor gave intelligence services early notice of vulnerabilities that had not been patched) That's an unfounded accusation. Micah Lee wrote a very concise refutation of his smear campaign.[1] > I would be sure someone couldn't pierce the veil of anonymity. That still doesn't contradict the fact that using Tor is better than not. [1] : https://micahflee.com/2014/12/fact-checking-pandos-smears-against-tor/

QubesOS has a really nice solution for opening untrusted PDFs: https://micahflee.com/2016/07/how-qubes-makes-handling-pdfs-way-safer/

They provide gpg signed sha hashes, it's apparently just not documented: https://micahflee.com/2016/02/backdoored-linux-mint-and-the-perils-of-…

http://blog.erratasec.com/2014/11/the-pando-tor-conspiracy-troll.html https://micahflee.com/2014/12/fact-checking-pandos-smears-against-tor/

Regarding that "disclaimer" in the corner, here's why it was added: https://micahflee.com/2013/11/canonical-shouldnt-abuse-trademark-law-t…

That really depends on whether or not I could afford to (the sad reality of our legal system). Fortunately, the EFF seems to be helping him: https://micahflee.com/2013/11/canonical-shouldnt-abuse-trademark-law-t…

Disclaimer: UK citizen. I don’t know anything about ICE or whose side I’m “supposed to be on” politically here. I’m just responding to the details in the article. The app might as well be TodoApp. The vulnerability couldn’t have been reported in a worse way. OP gave unreasonably short deadlines, allowed moral opinions about the software to interfere with responsible disclosure, and interspersed details about the potential vulnerability with inflamatory remarks about the mission of the product. I don't think OP's goal was actually to secure the app. OP was going to publish a scathing blog post about ICEBlock either way, and essentially engineered a situation where the ICEBlock author had to act within unreasonable timelines. He published the original blog post an hour and a half after reporting the vulnerability. Then gave a week’s deadline before another one. Sure, potentially the ICEBlock author also allowed feelings to interfere with upgrading the vulnerable version too. But ICEBlock has millions of users, according to the blog post. I’m cautious about upgrading dependency versions for apps I manage with <100 internal users. In my experience, upgrades are 99% trivial, and 1% cause disastrous headaches and downtime. If I were the ICEBlock author, I would put this on a list of things to look into, and ensure that it was tested thoroughly if I did decide to upgrade. It’s not as simple as running “sudo apt upgrade”. And I imagine that given the scale of the product, the…