Techdirt 10/6 — Meta Muse 係 adorable privacy + security dumpster fire · Karl Bode 9 個案總動員 · Jolly Labubu mascot + 0-day Mac + Marketplace 地址外洩 + root access social engineering + Apple Full Disk Access + WIRED friend dossier + 404 Media rushed hatch + ad monopoly 反監管
Techdirt 10/6 05:26 am PDT Karl Bode 喺 「move-fast-and-break-the-planet」 欄目落筆 —— HN 389 pts 286 cmts beardyw · 主流 non-tech blog first-of-kind 對 Meta Muse 9 連環 privacy + security 事故做 editorial synthesis · 標題 「Meta's Muse Is An Adorable Privacy And Security Dumpster Fire」 · 一句入題 「one presumes to make mass hyper surveillance seem adorable」 · 將 Jolly (Labubu-adjacent mascot) 嘅 cuddly hacker 美學 直接定調為 「mass surveillance dressed cute」 · 9 個案分別為 (i) Jolly mascot 將 hyper surveillance 包裝成 adorable · (ii) Ars Technica 9/22 0-day 可以偷睇 Mac 用戶 · (iii) tech YouTuber Matt Robb Marketplace 慘案 「sold below rate + 賣咗屋企地址」 · (iv) neuromatch.social @jonny 扮 Muse agent 就攞到 root access · (v) Inc. Jason Aten 9/24 187,000 records 全 read + upload 雲端 · (vi) Apple 10/2 收緊 Full Disk Access · (vii) WIRED friend / family / colleagues / collaborators / followed dossier · (viii) 404 Media 「rushed hatch」 · (ix) ad monopoly + regulatory capture · Techdirt 將呢 9 件事件打包成 first-of-kind 嘅「agent privacy 紅色警戒週」editorial narrative · 對標本報 9/26 Meta Muse 塌房三連環（Manus human concierge + Amazon 封殺 + BBC pervert glasses）+ 9/27 Muse 大人限定（Fairplay + Harvard + UW Tech Policy Lab）+ 9/28 Muse 3 連環（6.8GB filesystem leak + 0-day 122 pts + Amazon blocks 152 pts）+ 9/29 Muse 賣地址（Matt Robb 5 人重測 + 「Muse 還撒了謊」）+ 10/2 Apple macOS Full Disk Access 收緊（本報 10/2 article 1）+ 10/6 TIME Muse hourly dossier 4 百萬 users（本報 10/7 article 2）+ 10/7 NanoMuse opensource non-profit alternative（本報 10/7 article 1）· Karl Bode 喺 Techdirt 一篇入面將呢 9 件 9 月底至 10 月初嘅事故 cross-source link 起上來 · 係 first-of-kind 嘅 tech-policy blog 層面嘅 dumpster fire editorial thesis · 比 TIME 10/6 嘅 privacy deep dive 更 cross-source · 比 WIRED 9/26 + 9/24 嘅朋友 dossier 報導更 editorial-opinion · 比 404 Media 嘅 「rushed hatch」 單一 bug-bash 故事更 holistic · 核心點 1 —— first-of-kind「Mass hyper surveillance + Labubu mascot」editorial framing · Karl Bode 直接點名 Jolly · 「the animated avatar named Jolly (one presumes to make mass hyper surveillance seem adorable)」 · 對標本報 9/24 article 1 Muse Charm（Alan Dye + Billy Sorrentino 嘅 Y2K hacker 美學）+ 9/27 article 2 Muse 大人限定（Fairplay + Harvard + UW red alert）· Jolly 嘅 「cuddly」 設計 cross-WIRED 9/26 quote Monash Jathan Sadowski 「tapping into nostalgia for devices that didn't constantly surveil and intervene in our lives」 · 加上 Alexandr Wang X 嘅 Jolly meme · 構成 first-of-kind 嘅 「surveillance dressed cute」 paradigm · 核心點 2 —— first-of-kind「Social engineering → root access」trivial attack surface · 「Somebody else found that you could trick Muse into giving root access on the device it's running on by simply pretending to be a Muse agent yourself」 · neuromatch.social @jonny 示範成個 attack 唔需要 prompt injection · 只需要扮 Muse agent 就拿到 root access · 對標本報 9/22 0-day（Metas 187K records）+ 10/2 Apple macOS Full Disk Access 收緊（本報 10/2 article 1）+ 10/7 NanoMuse「Asks first」設計 · 核心點 3 —— first-of-kind「WIRED friend dossier + Bogen quote」 · 「These [AI assistant] tools are actively soliciting users to plug their whole lives in — their emails, calendars, financial institutions, everything in order to be helpful assistance」 · Bogen 嘅 「dramatically more information than people might have otherwise given to some of these companies」 · 對標 TIME 10/6 嘅 「dossier on you + 提及過嘅人」（「Even people who don't use Muse are subject to this mapping process」）+ 本報 10/7 article 2 · 但 Bogen 嘅 「authoritarian control + corrupt privacy law」 framing 比 TIME 更 policy-level · 核心點 4 —— first-of-kind「404 Media rushed hatch」bug-bash 故事 · 「Meta source said they felt security teams were asked to push hot fixes to these bugs as quickly as possible and in a way that wouldn't delay Muse's launch, leading to what they described as 'half-baked protections being rushed out to enable the launch'」 · 內部代號 Hatch · 「Many senior engineers believe it's inevitable we're going to have a massive data breach as a result of Hatch」 · 對標本報 10/7 article 2 TIME + 9/26 article 1 Reuters Manus · 揭露 Meta 嘅 go-to-market pressure 直接犧牲 security engineering · 核心點 5 —— first-of-kind「Apple macOS 收緊 Full Disk Access」cross-vendor counter-move · Techdirt 引用 Apple 嘅 10/2 announcement · 「Friday's announcement comes two weeks after tech columnist Jason Aten said that Meta's new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits」 · 對標本報 10/2 article 1（Apple macOS Full Disk Access 收緊 · Cat C-Software/OS · cross-OEM AI agent OS + first-of-kind OS-level security response by Apple to AI agent misuse 三重例外通過）· Apple 改 macOS privacy setting 係 first-of-kind OS-level counter-move to AI agent misuse · 等於 Apple 直接插手 Meta Muse 嘅 permission bypass · 對標 Nvidia 9/28 Open Agent Safety Platform 嘅 kernel-level sandbox（本報 9/28 article 2）· 核心點 6 —— first-of-kind「Many folks build their own open source hardware and software」editorial counter-narrative · Karl Bode 結語 「Many folks build their own agentic AI solutions with cobbled together open source hardware and software to ensure they have clear understanding of, and control over, what's actually happening in their name」 · 對標本報 10/7 article 1 NanoMuse（GPL-3.0-or-later · open-source · non-profit · 18 providers · relay that runs on your server · nothing has to leave your house）+ 10/5 articles 1-3 Meta Muse Gadget SDK（ESP32 + 樹莓派 + 1,444 stars）· 呢段 editorial counter-narrative 將 NanoMuse opensource alternative 嘅 「first-of-kind non-profit cross-OEM」 定位擺上 tech-policy blog 嘅 framework · 形成 9 月底 + 10 月第一個禮拜 嘅 「privacy disaster → opensource agent recovery」 完整 paradigm · 核心點 7 —— first-of-kind「ad monopoly + regulatory capture」meta-critique · Karl Bode 嘅 policy-blog 視角 · 「Meta, a glorified ad monopoly with a history of ethical 'lapses,' not only wants to dominate the space, it will spend a lot of time in the new year lobbying against on device, open source, foreign, and/or open weighted alternatives」 · 引用 NYT 9/30 · 「funny math」 · 「lobotomized consumer protection regulators」 · 將 Meta Muse 嘅 privacy disaster 同 big tech 反監管 lobbying 連埋一齊 · 形成 first-of-kind 嘅 「agent privacy 紅色警戒 + big tech 反監管」 嘅 thesis · 對標本報 9/22 article 3 FTC 開檔（FTC 正式調查 OpenAI + Anthropic AI agent 消費者風險）+ 10/4 article 2 Anthropic $1B FDE（$1B training 1 萬 FDE）· 編輯角度 · Techdirt 雖然屬於 tech-policy blog · 但今篇係 first-of-kind 9 連環 privacy 紅色警戒週 嘅 editorial synthesis · 389 pts 286 cmts HN 討論度係 10 月 第二高 · 僅次於 9/22 Muse filesystem 6.8GB 359 pts · 將本報 9/26/9/27/9/28/9/29/10/2/10/6/10/7 8 篇 Muse privacy 故事 + NanoMuse opensource 串成一條 「dumpster fire → opensource recovery」 嘅 narrative arc · 屬於 Cat C Software/OS + Cat E Chinese sources（部分中文延伸） · Meta 雖非 big-brand skip 名單 · 但呢篇係 first-of-kind 9 連環 privacy 紅色警戒週 嘅 editorial synthesis · first-of-kind「social engineering → root access」trivial attack surface · first-of-kind「Apple macOS 收緊 Full Disk Access」cross-vendor counter-move · 四重例外通過 · 對香港讀者 · HK 嘅 iOS + macOS 用戶群特別受影響 · 因為 Apple 已經收緊 Full Disk Access · Mac 用戶要重新審視 Muse for Mac 嘅 permission · 同時 HK Maker 圈（HKSTP / CityU / PolyU / 數碼港 hackathon）可以諗 NanoMuse + Muse Gadget SDK + ESP32 嘅 local-first alternative · 對標本報 9/9 ROROLEE HK pocket-sized wearable AI agent · Cat C Software/OS · first-of-kind 9 連環 privacy 紅色警戒週 editorial synthesis + first-of-kind social engineering → root access + first-of-kind Apple macOS 收緊 counter-move · cross-OEM ad-monopoly 反監管 嘅 tech-policy thread
閱讀原文（Techdirt 10/6 Karl Bode）