Data & Law
What's digital sovereignty and how to practice it
Digital sovereignty isn't some abstract concept. It's about deciding who gets access to your data, where it lives, and what happens if a provider vanishes.
Philosophy
Radars right now
SIGNAL When iMessage fails, your messages go out in the clear When iMessage drops out, your iPhone falls back to SMS or unencrypted RCS without a real warning. Three Messages settings stop the fallback. Read the radar
When iMessage or encrypted RCS drops out, Messages moves the conversation to unencrypted RCS, SMS or MMS, in the same thread. No alert, just a discreet mention. Three iPhone settings shut these fallbacks down. An iMessage that can't go out encrypted then stays failed, and you decide whether to send it anyway.
What you need to do
1. Turn off Resend as Text Message (Retry as Text Message on some iPhones), in Settings > Apps > Messages. An iMessage that fails stays failed instead of going out as SMS.
2. Turn off RCS Messaging, in its own submenu, if you want no fallback to unencrypted RCS. You also lose encrypted RCS, where your carrier offers it. In France, Orange, SFR, Bouygues Telecom and Free offer RCS, none encrypts it on iPhone yet, so you lose no encryption.
3. Turn off MMS Messaging. Even with the SMS fallback off, Messages can still fall back to MMS.
ALERT Self-hosted Nextcloud, a Collabora flaw already exploited A critical flaw in Nextcloud's built-in Collabora opens your server without a password. Check, hunt for the intruder, update it or remove it. Read the radar
A critical flaw in Nextcloud's built-in Collabora lets anyone run commands on your server without a single password, and administrators have already found backdoors on theirs. A patched built-in Collabora has been available since September 11 for Nextcloud 30 and later, but updating it does not evict an intruder who is already in.
What you need to do
1. Check whether the built-in Collabora (the richdocumentscode app) is installed on your Nextcloud, and which version. Before version 26.4.303 of the built-in Collabora, you are exposed. A Collabora installed separately, connected through Nextcloud Office, is not affected.
2. Hunt for a backdoor before you patch, unexpected PHP files in the built-in Collabora folder and suspicious requests in your logs since September 10.
3. Update the built-in Collabora to 26.4.303 or later, or remove it. Disabling it is not enough. If your Nextcloud runs version 29 or older, this update is not offered to you, update Nextcloud first. Aim for Nextcloud 33 or later in any case, earlier versions are no longer maintained.
4. If you find an intruder, change every secret your web server can read. The commands are in the full radar.
Latest
Series Your AI Getting started
AI Agents Under Control
Your AI agent has the keys to your house. A prologue, then six episodes to lock down what it reads, what it runs and what it sends, without giving it up.
1 of 7 published
Latest Your AI agent has the keys to your house
Privacy Explainer Getting started
Your AI talks to ad networks, mute its mic
An IMDEA study measured nine AI assistants. The address, the title, sometimes your message go to Meta, TikTok or Google. What leaks, and the fix on Mac.
Mac Security Tutorial Getting started
Stop living as an administrator on your Mac
Your first Mac account is an administrator. Move your daily life to a standard account, keep a separate admin, without losing data or locking yourself out.
AI
See more →
Series Your AI Going further
Your SSH Keys vs AI Agents
An AI agent works with your rights and your keys. Lock it down before it does any damage.
2 episodes · complete series
Series Your AI Getting started
Your AI, at Home
An AI that runs on your Mac, offline, from picking the model to plugging it into your real work.
3 episodes · complete series
Your AI Tutorial
MCP servers, the backdoor into your AI
MCP servers give your AI real access to your Mac: files, shell. Handy, but it's a backdoor. Here's how to lock it down.
Privacy
Apple Intelligence, what's really leaving your Mac
Your Mac switched Apple Intelligence to ON without telling you. Three layers of processing, only one stays with you. And no one mentions the linked OpenAI account trap.
Tutorials
See more →
Mac Security Tutorial Getting started
Antivirus alone no longer protects your Mac
An antivirus recognizes what it knows, and 2026's Mac attacks slip past it. Detect, filter execution, control egress, the trio that holds.
Series Self-hosting MS Pro
Make Your SIEM Talk
Your SIEM is running, now make it talk, read the right logs, write your own rules, correlate, then let it act.
3 of 5 published
Self-hosting Tutorial Getting started
Mac and Tailscale, your private WireGuard network in 15 min flat
Build an encrypted private network across all your Macs in 15 minutes, without opening a port or touching your router. Install, MagicDNS, remote file access, reaching your services without exposing them, the real limits.
Series Self-hosting MS Pro
Build Your Sovereign SIEM
Build your own SIEM on a European VPS, from a hardened base to alerts that actually ring, without a single byte on a US cloud.
8 episodes · complete series
Latest Alerting and total cost, the final tally of your sovereign SIEM
No Big Tech Tutorial Getting started
Switching from Gmail to ProtonMail on Mac
Switching from Gmail to ProtonMail on Mac without losing any emails. Import, redirect, contacts, native app or Bridge, the whole process step-by-step.
Mac Security Tutorial Getting started
Why your mail client is a sieve, and how to fix it
Spy Pixels, HTML Exploits, Outlook Zero-Days. Your Email's Attack Surface is Way Bigger Than "Gmail Reads You". Comprehensive Guide to Fix It.
Comparisons
See more →
No Big Tech Comparison Getting started
Leaving Google Photos for Proton, Ente or Immich?
Leaving Google Photos, two encrypted clouds (Proton, Ente) and two options to host yourself (Ente, Immich). Compare before you choose.
Privacy Comparison Getting started
De-Googled browsers, the false choice they sell you
Brave, Firefox, Safari, Librewolf. Most alternatives to Chrome run on Google's engine. Engines, exploited flaws and agentic AI, the essentials.
No Big Tech Comparison Getting started
kSuite vs Google Workspace, the honest comparison
kSuite Infomaniak or Google Workspace for your Mac? Pricing, encryption, jurisdiction, native Apple apps. The honest comparison, no marketing fluff.
Mac Security Comparison Getting started
Little Snitch vs LuLu, which outgoing firewall for your Mac
Little Snitch paid and closed-source vs LuLu open-source and free. Max sovereignty on one side, max granularity on the other. How to choose without regrets.
Explainers
See more →
Data & Law Explainer
Your email provider has ten days to hand you over
Since 18 August 2026, your email data can be handed over within ten days to an authority in any member state, without a judge in your country.
Mac Security Explainer Going further
Code signing, the shared anchor of Santa and Little Snitch
A Little Snitch alert on your backup is not necessarily a missing signature. What code signing really controls, with Santa in parallel.
Data & Law Explainer
Passwork, « Made in EU » outside, FSB-certified inside
A tool sold as Made in EU, with code pushed from Russia. The label has no legal weight. Here's the checklist to vet your software supply chain.
Mac Security Explainer
Your Mac was patched by XProtect without your knowledge, it's for your own good
On May 11, 2026, 170 npm packages in the TanStack ecosystem were compromised in six minutes. The next day, Apple pushed an XProtect signature onto your Mac without telling you. Here's how to check.
No Big Tech Explainer Getting started
Proton Meet, end-to-end encrypted video calls
Proton encrypts your calls end-to-end using MLS. Even Proton can't snoop on your meetings. How it really differs from Zoom, Teams, and Google Meet.
Mack
Privacy isn't a subscription you pay to Big Tech.
@macsouverain
@macsouverain.bsky.social