Firewalls Don't Stop Dragons Podcast

Radio frequencies are all around us – invisible airwaves crackling with life, antennas bristling with energy. Traveling on those airwaves is information of all sorts – much of it available for free, if you have the right equipment. Amateur radio has been around for well over a century now and is still popular today, despite the prevalence of cell phones and the internet. Unlike those services, these radios don’t need any third party infrastructure or even mains power to operate, making them invaluable during times of crisis. But they also have a ton of cheap and fun uses that you may not be aware of. We’ll discuss all of this and more with Josh Nass, creator of the marvelously entertaining Ham Radio Crash Course site.

Interview Notes

Ham Radio Crash Course: https://hamradiocrashcourse.com/ 

HRCC getting started series: https://www.youtube.com/playlist?list=PL1KAjn5rGhiy7JSmJHjUaUB47jPrd-xbK 

Ham Study: https://hamstudy.org/ 

NATO Phonetic alphabet: https://learnthephoneticalphabet.com/ 

KiwiSDR: http://kiwisdr.com/public/ 

PACE strategy: https://en.wikipedia.org/wiki/PACE_(communication_methodology) 

CERT training: https://www.ready.gov/cert 

SDR kit: https://www.amazon.com/dp/B0BMKB3L47 

FM Transmitter (Simple) by VA3AVR: https://www.learningelectronics.net/VA3AVR/circ/fmt7.html#google_vignette 

How To Build A Dipole Antenna: https://www.radio4all.org/how-to-build-a-dipole-antenna/ 

Gordon West ham prep: https://www.arrl.org/gordon-west 

Further Info

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support the mission: https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:14: Intro

0:01:39: A little background

0:04:08: Lingo

0:06:04: How did you get into amateur radio?

0:10:43: Why get a ham license?

0:15:56: What fun can I have without a license?

0:19:31: What’s a good first radio?

0:23:09: Do I really need a license?

0:27:07: How do you test your EmComms?

0:35:28: What is CERT about?

0:42:30: How does Meshtastic work?

0:51:46: What’s a good family comms setup?

0:54:24: What if I want to get into community EmComms?

1:00:26: What are some fun radio projects?

1:03:17: What’s next for you and HRCC?

1:05:47: Wrap-up

1:07:26: Getting started w/ ham radio

1:09:59: More on Meshtastic

1:10:47: Software defined radio (SDR)

1:11:16: More on CERT

1:12:25: Phase 3 ideas

1:13:15: Patron podcast preview

1:13:51: Looking ahead

It’s been a rough month if you work in cybersecurity. Some are calling it Black October. Today we’ll talk about two of the major security events: PHP2Shell and eMudhra’s TLS certificates. But we’ll also have some fun AI news, too, including the second half of my tutorial on making your own apps using a free chatbot.

In other news: Google fixes serious Pixel phone bugs; North Korea blamed for $6.3B crypto heist; Google using your email, photos for ads targeting; NM judge fines Meta $25B; Israeli firm used ads to deliver spyware; Utah judge rules VPN law invalid; CA public school data leak; Canada’s Crime Stoppers leaks 1.5M tips spanning decades; DHS breached affecting 41k employees; people are hacking their smart TVs to make them dumb.

Article Links

110 vulnerabilities fixed in Google Pixel devices. [kaspersky.com – Alanna Titterington – Oct 2, 2026]: https://www.kaspersky.com/blog/google-pixel-september-2026-security-update/56488

North Korean hackers blamed for stealing record $6.3B in Binance breach. [techcrunch.com – Zack Whittaker – Oct 30, 2026]: https://techcrunch.com/2026/10/30/north-korean-hackers-blamed-for-stealing-record-6-3b-in-binance-breach

How to stop Google using your Gmail and Photos for ads. [proton.me – Ben Wolford – Oct 27, 2026]: https://proton.me/blog/gmail-ads

Meta ordered to pay New Mexico $25 billion for deceiving users about privacy on Facebook. [apnews.com – https://apnews.com/author/mikella-schuettler – Oct 21, 2026]: https://apnews.com/article/facebook-penalty-cambridge-analytica-new-mexico-b329f82c3d3db3758a159405acbd4d0e

Israeli firm used online ads to run vast spy operation, researchers say. [reuters.com – Raphael Satter – Oct 15, 2026]: https://www.reuters.com/legal/litigation/israeli-firm-used-online-ads-run-vast-spy-operation-researchers-say-2026-10-15

Court Agrees with EFF: Utah’s VPN Law Demands a Technical Impossibility. [eff.org – Rindala Alajaji – Oct 6, 2026]: https://www.eff.org/deeplinks/2026/10/court-agrees-eff-utahs-vpn-law-demands-technical-impossibility

Hackers steal personal data of millions of California students in massive breach. [msn.com – Howard Blume, Andrew Khouri, Jaweed Kaleem – Oct 15, 2026]: https://www.latimes.com/california/story/2026-10-16/state-testing-student-data-hack

Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents. [wired.com – Dhruv Mehrotra – Oct 28, 2026]: https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents

More than 1.5 million Canadian Crime Stoppers tips leaked. [cbc.ca – Valérie Ouellet, Michelle Allan – Oct 21, 2026]: https://www.cbc.ca/news/investigates/canadian-crime-stoppers-tips-leaked-hack-investigation-9.7388820

The Internet goes on high alert after discovery of 8 compromised TLS certs. [arstechnica.com – Dan Goodin – Oct 20, 2026]: https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs

AI Is Changing Everything About Hacking. No One Knows What Happens Next. [404media.co – Jason Koebler – Oct 22, 2026]: https://www.404media.co/php2shell-black-october-ai-is-changing-everything-about-hacking-no-one-knows-what-happens-next

People are using AI to make their smart TVs dumb again. [techcrunch.com – Sarah Perez – Oct 19, 2026]: https://techcrunch.com/2026/10/19/people-are-using-ai-to-make-their-smart-tvs-dumb-again

Tip of the Week: https://firewallsdontstopdragons.com/sample-ai-app-photomd/ 

Further Info

De-Google your life: https://firewallsdontstopdragons.com/reducing-my-google-footprint/ 

Archive old email: https://firewallsdontstopdragons.com/withdraw-your-data-email/ 

Minimize your data: https://firewallsdontstopdragons.com/data-diet-introduction/ 

Freeze four credit: https://firewallsdontstopdragons.com/credit-freeze-now-is-the-time/  

Back up your data: https://firewallsdontstopdragons.com/you-must-have-data-backups/ 

Check bad certificates: https://emudhra.we-have-a-problem.com/ 

Censys PHP2Shell tracker: https://php2shell.censys.com/ 

Create a security.txt file: https://securitytxt.org/ 

Table of Contents

0:00:07: Intro

0:01:16: News rundown

0:03:17: Update Pixel phones ASAP

0:03:51: $6.3B crypto heist

0:05:21: Google to use Gmail, Photos for ads

0:07:20: Judge fines Meta $25B

0:08:38: Israeli firm used ad to implant spyware

0:10:30: Utah judge rules VPN ban infeasible

0:12:24: CA public school student data leaked

0:14:13: DHS breach impacts 41,000 employees

0:16:40: Canada Crime Stoppers leaks 1.5M tips

0:22:58: Weak TLS certificates leaked

0:37:19: Explaining PHP2Shell

0:49:14: Carey’s take on Black October

1:01:20: People are hacking their TVs

1:05:20: Tip of the Week

1:11:25: Wrap-up

1:12:16: Looking ahead

1:12:35: Patron podcast preview

1:12:48: 2026 Gift Guide

As with many consumer protection laws, California is leading the way with regard to data privacy. In recent years, with the Delete Act and the DROP tool (Delete Request and Opt-out Platform), California residents have gained a lot more power over who can collect their personal data and even been given a simple, one-stop site for requesting deletion of all their data from third parties. And thanks to CA, we will all have the ability to globally request that websites not collect or share our personal data with a simple browser setting. I’ll be discussing these wonderful tools with the Executive Director of CalPrivacy, Tom Kemp, and how they can even help non-residents to claw back some control of their data on the web.

Interview Notes

CalPrivacy: https://privacy.ca.gov/ 

DROP tool: https://privacy.ca.gov/drop/ 

Global Privacy Control: https://globalprivacycontrol.org/ 

States honoring GPC: https://cookiechimp.com/blog/global-privacy-control-gpc 

Enable GPC: https://firewallsdontstopdragons.com/how-to-enable-global-privacy-control/ 

Data broker deletion: https://firewallsdontstopdragons.com/dragon-hacks-opt-out/ 

PHP checker: https://github.com/PrivacySafe/security-patches 

Further Info

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support the mission: https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:18: Intro

0:01:21: Interview setup

0:03:45: What’s it like bring on the inside?

0:10:37: Are companies complying or resisting?

0:14:41: Do states lead the way if feds can’t?

0:21:18: How does GPC work?

0:25:57: What states currently honor GPC?

0:32:27: What did we learn from Do Not Track?

0:35:03: How do we curb tracking in the real world?

0:39:45: How does DROP work?

0:46:39: Have these laws impacted the data broker industry?

0:51:03: Does transparency drive action?

0:55:44: So what can we do?

0:58:18: What’s next for CalPrivacy?

1:00:46: Wrap-up

1:03:48: Patron podcast preview

1:04:35: Looking ahead

In the past, we’ve been told that “there’s an app for that” – meaning, if you search the app store, surely you can find a pre-existing app that does what you’re looking for. But maybe it does a lot of stuff you don’t want, too. Maybe it’s chock full of ads or extracts your personal info. Maybe it just costs too much or requires a subscription. But you now have the power to create your own custom apps, without knowing a single thing about coding. I’ll explain how.

In the news: Microsoft fixes a record 1400+ bugs this month; US shuts down dozens of North Korean laptop farms; how to validate Amazon messages; Google starts linking all your accounts to your phone; European solar, wind farms vulnerable online; your car shares lots of your data; AI can pinpoint dwellings from a single internal photo; Amazon rolling out smart glasses to drivers; Google is saving your voice, video, photos from AI; OK judge rules ALPR searches require warrants; creator has vibe-coded replacements for Adobe, Microsoft suites.

Article Links

Microsoft Patches More Than 1,400 Security Flaws: https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws

U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud: https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html

PSA: How to check if that Amazon call, email, or text message is a scam: https://this.weekinsecurity.com/how-to-check-if-that-amazon-call-email-or-text-message-is-a-scam

PSA: Google is silently linking your phone number across all signed-in accounts: https://www.androidauthority.com/google-auto-phone-number-verification-android-3723117

Thousands of European wind and solar power systems exposed online: https://www.reuters.com/technology/thousands-european-wind-solar-power-systems-exposed-online-dutch-researchers-say-2026-10-06

Your Car Is Sharing Data With Big Tech Companies, Study Finds: https://www.consumerreports.org/electronics/personal-information/your-car-is-sharing-data-with-big-tech-companies-study-finds-a4474820962

AI Company Lets Cops Pinpoint Specific Houses Based on a Single Interior Photo: https://www.404media.co/ai-company-lets-cops-pinpoint-specific-houses-based-on-a-single-interior-photo

Amazon Drivers’ Smart Glasses Are Going to Be an Image Problem: https://www.bloomberg.com/opinion/articles/2026-09-30/amazon-drivers-smart-glasses-are-going-to-be-an-image-problem

Google Just Quietly Started Saving Your Photos and Voice: https://medium.com/@mohameddosou/google-just-quietly-started-saving-your-photos-and-voice-61eb37ced542

Oklahoma judge’s Flock ruling shows the power of Supreme Court’s digital evidence decision: https://therecord.media/oklahoma-flock-ruing-supreme-court-chatrie-decision

Creator of free Adobe clones unveils open-source Microsoft Office replications: https://www.tomshardware.com/software/microsoft-office/creator-of-free-adobe-clones-unveils-open-source-microsoft-office-excel-powerpoint-and-word-replications-autodesk-tools-and-other-subscription-based-services-may-come-next

Tip of the Week: https://firewallsdontstopdragons.com/build-your-own-apps-with-ai/ 

Further Info

Google’s My Activity settings: https://myactivity.google.com/myactivity 

ArtCraft apps: https://getartcraft.com/apps 

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support our mission! https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:07: Intro

0:00:23: Book update

0:02:21: News rundown

0:04:38: Microsoft patches 1400+ bugs

0:07:05: FBI shuts down NK laptop farms

0:09:21: PSA: Amazon Message Center

0:11:30: Google linking all accounts to number

0:14:01: European solar, wind facilities found vulnerable

0:17:29: Cars collect and share lots of data

0:25:58: AI app IDs homes from interior pics

0:35:55: Amazon driver glasses and privacy

0:45:23: Google training on your media

0:53:43: Judge says ALPR searches require warrant

1:00:43: AI recreates MS Office, Adobe suite

1:07:28: Tip of the Week

1:16:43: Wrap-up

1:17:29: Patron podcast preview

1:17:50: Looking ahead

Residential proxy networks have become very popular ways for bad guys to launder their illicit activities through our normal home network traffic. By mixing in their traffic with ours, they are able to use (and abuse) the good reputation of our home IP address. Many of us have unwittingly allowed this to happen by using cheap streaming boxes or installing shady apps on our smart TVs. Today we’ll discuss residential proxies and botnets with Dan Goodin, Senior Security Editor at Ars Technica.

Interview Notes

Dan Goodin: https://arstechnica.com/author/dan-goodin/ 

Dan on router security: https://arstechnica.com/security/2026/07/the-us-government-warns-that-russia-state-hackers-are-coming-after-your-router/ 

Brian Krebs story: https://krebsonsecurity.com/2026/06/popa-botnet-linked-to-publicly-traded-israeli-firm/ 

Greynoise IP reputation: https://check.labs.greynoise.io/ 

OpenWRT: https://openwrt.org/docs/start 

Shields Up!: https://www.grc.com/shieldsup 

Further Info

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support the mission: https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:16: Intro

0:02:03: Lingo

0:05:01: How did you get into security?

0:08:59: What is a residential proxy?

0:15:08: Who’s behind these proxy networks?

0:19:12: What is a botnet?

0:22:03: How are home devices compromised?

0:30:01: Can I be liable for proxied attacks?

0:33:00: How do you take down a botnet?

0:39:12: Should the gov’t unhack our devices?

0:43:03: Can we detect proxy devices?

0:47:43: Wrap-up

0:53:28: Patron podcast preview

0:53:47: Looking ahead