Glossary

You run into these terms in Mac Souverain’s articles. Here’s what they mean, and what they change for you, without the useless jargon.

0-9 · A · B · C · D · E · F · G · H · I · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Z

By topic

Encryption
ADP · Client-side encryption · Client-side scanning · DLP · DNSCrypt · Ed25519 · Encryption at rest · End-to-end encryption · Forward secrecy · Harvest now, decrypt later · Homomorphic encryption · HTTPS · IMAP Bridge · iMessage · KMS · Matrix · Metadata · MLS · OpenPGP · Post-quantum · RCS · S/MIME · SecretAgent · Secretive · Secure Enclave · Signal Protocol · Vault eDiscovery · XTS-AES-128 · Zero-knowledge

Messaging
APNs · Easy Switch · Forward secrecy · IMAP · IMAP Bridge · iMessage · Linked device · Matrix · MLS · OpenPGP · RCS · Registration Lock · Rspamd · S/MIME · Signal Protocol · SMS / MMS · SMTP · Tracking pixel · vCard

DNS and networking
ALF · Authoritative server · Blocklist · Captive portal · Diameter · DNS · DNS leak · DNS resolver · DNS-over-HTTPS · DNS-over-TLS · DNSCrypt · dnscrypt-proxy · DNSSEC · ECH · Evil Twin · Global Title leasing · HTTPS · iCloud Private Relay · ISP · Kill switch · Man-in-the-middle · Mesh network · NEFilterDataProvider · No-logs · Process-aware outbound firewall · Root server · Server-side tracking · SMS / MMS · SNI · SS7 · SSL stripping · Tailscale · Telecom interconnection · TLD · Unbound · VPN · WebDAV · WireGuard

Apple hardware and system security
ABM / Managed Apple ID · ADP · ALF · Allowlisting · APNs · ATT · BootROM · CDHash · CloudKit · Code signing · Configuration profile · Daemon · DMA · Endpoint Security · Full Disk Access · iCloud Private Relay · iPhone supervision · KIP · Lockdown · MDM · MIE · MTE · NEFilterDataProvider · Neural Engine · PAC · Private Cloud Compute · Process-aware outbound firewall · ROP / JOP · Santa · SDP · SecretAgent · Secretive · Secure Enclave · Sideloading · SigningID · SIP · SoC · T2 · TCC · TeamID · Trusted System Agent · Unified memory · xattr · XPR · XProtect · XTS-AES-128

Surveillance, law and regulation
5/9/14 Eyes · Age broker · Age verification · ANSSI · APNs · ATT · Blocklist · Browser fingerprinting · Client-side scanning · CLOUD Act · Coalition Against Stalkerware · CRA · CSAR · Cyber Solidarity Act · Data Privacy Framework · Diameter · DINUM · DMA · DORA · eIDAS 2.0 · FISA 702 · FSB · FSTEC · Global Title leasing · Identity broker · International mutual legal assistance · IPA · IPT · ISO 27001 · MAID · Metadata · NIS2 · nLPD · NSL · Online Safety Act · RTB · Schrems II · SDK · SecNumCloud · Server-side tracking · Sideloading · SIMjacker · SOC 2 Type II · SS7 · Stalkerware · TCN · Telecom interconnection · Telemetry · Tracker · Tracking pixel · Trilogue · Trusted System Agent · Vault eDiscovery · World ID

Malware and attacks
Allowlisting · AMOS · Bearer token · Browser exploit · C2 · Captive portal · ClickFix · Coalition Against Stalkerware · Code signing · CTI · CVE · EDR · Electron · Evil Twin · Fileless · Infostealer · IOC · iPhone supervision · Linked device · Malvertising · Man-in-the-middle · MFA · npm · OAuth · OAuth consent phishing · Page cache · Polymorphic · Privilege escalation and lateral movement · Pull request · Ransomware · RCE · Registration Lock · ROP / JOP · Santa · Seccomp · SIMjacker · Software supply chain · SSL stripping · Stalkerware · Supply chain attack · Template injection · User namespace · xattr · XPR · XProtect · Zero-day

Self-hosting, backup and SIEM
3-2-1-1 rule · Active response · Agent · Alert fatigue · Bouncer · CAPI · Correlation · CrowdSec · CTI · Daemon · Deduplication · Docker · Enrollment · EPS · FIM · Full Disk Access · Git · Git forge · Indexer · Integrator · kDrive · Kopia · Matrix · OnlyOffice · Open source · Page cache · Pull request · Ransomware · Rspamd · S3 · Santa · SCA · Seccomp · SIEM · Tailscale · ufw · unattended-upgrades · Unbound · User namespace · vCPU · Vendor lock-in · VirtioFS · VPS · Wazuh · Wazuh vocabulary · WebDAV

Local AI
GGUF · Homomorphic encryption · Hugging Face · Inference · Local LLM · MCP · Neural Engine · Ollama / LM Studio / MLX · Open-weight · Parameters · Private Cloud Compute · Quantization · Unified memory

0-9

3-2-1-1 rule (backups)

Three copies of your data, on two different media, one of them off site and one offline.

The last “1”, the disconnected copy, was added to the historic 3-2-1 rule to answer ransomware that also encrypts backups reachable online. Paired with a client-side encrypted backup tool (Kopia, restic, Borg) and restores tested every quarter, it is the bare minimum.

See also: Ransomware · Kopia · Deduplication

5/9/14 Eyes

Intelligence alliances between countries that pool their surveillance data.

5 Eyes: United States, United Kingdom, Canada, Australia, New Zealand. 9 Eyes: the 5, plus Denmark, France, Netherlands, Norway. 14 Eyes: the 9, plus Germany, Belgium, Italy, Sweden, Spain. A VPN or cloud provider based in a member country can be compelled to hand over your data on government order, and its alliance neighbors get the benefit.

↑ Back to top

A

ABM (Apple Business Manager) / Managed Apple ID

Apple web console that lets an organization manage its devices, its apps and its employees’ Apple accounts.

It creates Managed Apple IDs, accounts the organization administers: it can suspend, reset or delete them, and some features are switched off (Apple Pay, purchases without approval). It also deploys devices through MDM with zero hands-on setup and federates with an existing directory (Entra ID, Google Workspace, Okta). For an Apple fleet, it is the equivalent of the Google or Microsoft admin consoles.

Active response

Wazuh module that runs a script in reaction to an alert: ban an IP, kill a process, cut a session.

The SIEM goes from spectator to actor. Powerful and dangerous: badly tuned, it can lock you out of your own infrastructure on a single false positive. Only wire it up once you know your rules by heart, with a list of addresses that are never blocked, your admin IP first in line.

See also: Integrator · Bouncer · Wazuh

ADP (Advanced Data Protection)

iCloud option that hands the encryption keys for nearly all your data to your devices alone.

Once it is on (System Settings > [your name] > iCloud), Apple can no longer read that data, even under a court order. Big exceptions: iCloud Mail, Contacts and Calendar stay readable by Apple, to remain compatible with IMAP, CalDAV and CardDAV. For end-to-end encrypted email, you need another service. In February 2025, Apple withdrew it in the United Kingdom under government pressure, and had still not restored it there as of October 2026.

See also: Client-side encryption · TCN · CLOUD Act

Age broker

A public or private actor that certifies your age on behalf of a third-party service and answers it with a yes or a no.

The platform delegates, without seeing your papers. In 2026, two US texts handed this role to OS vendors (Apple, Google, Microsoft): Illinois law HB 5511, passed in 2026, and the federal proposal HR 8250, introduced in April 2026. In the United Kingdom, the Online Safety Act relied instead on accredited providers. The risk: centralization with two or three players, possible cross-referencing with other data, and most often no zero-knowledge guarantee.

Age verification

Obligation on online services to verify their users’ age before letting them reach certain content.

Several jurisdictions now require strong verification: ID document, biometrics, bank card or OS attestation. In 2026, the main implementations were British, Australian, Brazilian (Law 15.211/2025, in force since March 2026) and European. In the United States, Illinois passed HB 5511 in 2026, applicable in 2028, and a federal proposal (HR 8250) was still in committee. In March 2026, an open letter from 371 security researchers, among them Ronald Rivest, called these rollouts “dangerous and socially unacceptable”.

Agent (SIEM)

Small probe installed on every machine in the fleet, which sends logs, events and file integrity up to the manager.

Server, Mac, Windows workstation: without an agent, the SIEM only sees itself; with one, it sees the whole fleet. With Wazuh, the agent is lightweight, free and unlimited in number.

See also: Enrollment · SIEM · Full Disk Access

Alert fatigue

State of a team that gets so many alerts, often false or duplicated, that it ends up ignoring them.

A real incident then slips by with the rest. It’s worse than no alerting at all, because you think you’re covered. You fight it by calibrating thresholds (which level notifies which channel) and by deduplicating upstream, in the rules themselves, never at notification time.

See also: SIEM · Correlation · Wazuh vocabulary

ALF (Application Layer Firewall)

Firewall built into macOS since 2007, which filters incoming connections app by app.

You allow one app to receive connections, you block another. What it doesn’t do: filter outbound traffic. To know which app talks to which server, you need a third-party tool (Little Snitch, LuLu). Turn it on in System Settings > Network > Firewall.

Allowlisting (binary authorization)

Principle that only lets approved programs run, everything else is blocked by default.

It is the opposite of the antivirus chasing known threats. On a Mac, Santa in Lockdown mode refuses at launch any unapproved binary, including a stealer dropped after the fact. Its limit: code that stays pure script goes through an interpreter that is already allowed (bash, osascript), hence caution with copy-paste. And the list needs upkeep, every new tool is one more rule.

AMOS (Atomic macOS Stealer)

Mac infostealer sold by subscription, one of the most widespread on macOS since 2023.

It sweeps up the Keychain, session cookies, crypto wallets and whole files, then sends them to a C2 server. It spreads through manipulation: fake “cracked” apps, fake installers, commands pasted into Terminal. Continuously updated and polymorphic, it stays a step ahead of signature antivirus.

See also: Infostealer · ClickFix · Polymorphic

ANSSI (French national cybersecurity agency)

France’s cybersecurity authority, reporting to the Prime Minister.

It publishes security frameworks, coordinates the response to major incidents and steers the transposition in France of European directives such as NIS2: listing the entities in scope, compliance guides. It is also the body that grants the SecNumCloud qualification.

APNs (Apple Push Notification service)

Apple infrastructure through which every push notification to your iPhones and Macs travels.

When an app sends you a message, the notification first goes through Apple’s servers. Apple sees their metadata and can hand it to the authorities under a judicial warrant. Set Signal and iOS to hide notification name and content: the message text no longer appears in what travels through.

ATT (App Tracking Transparency)

Apple mechanism, introduced with iOS 14.5 in 2021, that forces every app to ask your permission before tracking you elsewhere.

The tracking in question relies on your device’s advertising identifier (MAID). Serious limit: ATT doesn’t touch an app that has a legitimate reason to access your location (weather, navigation). That location can still end up in ad auctions, through the SDKs embedded in the app.

Authoritative server (DNS)

DNS server that holds the official answer for a given domain.

For proton.me, these are the servers run by Proton or its delegate. It is the one that gives the IP address to the resolver at the end of the chain. It only sees the queries that concern it, never the whole of what you ask for, which makes recursive resolution more respectful of your privacy than a centralized resolver.

B

Bearer token

Token a service hands you after you sign in, which is enough, as long as it is valid, to act in your name.

Bearer means holder: whoever holds it is treated as you, with no password or two-factor, which only protect the moment it is issued. A stolen token stays accepted until it expires, and a plain local logout doesn’t revoke it on the service side. The real fix goes through your account: invalidate the sessions and change the key involved.

Blocklist

List of domains or addresses, often kept up to date by a community, that your tool refuses to contact: ads, tracking, telemetry, malware.

You subscribe to it in an outbound firewall, a filtering DNS resolver or a browser blocker, and thousands of known destinations drop at once, with no rule to write. Its strength is also its limit: it only blocks what it knows. A brand-new domain, a measurement service deemed harmless or a server-side relay slip through. Prefer a lighter version to limit breakage, and add targeted rules on top.

BootROM

Boot code etched into the Apple Silicon chip at manufacturing, impossible to modify by software.

It is the first link in the secure boot chain: it verifies the authenticity of every component that starts after it. Malware cannot rewrite it, since it is physically frozen in the silicon.

Bouncer (CrowdSec)

CrowdSec component that enforces the engine’s decisions, for example by banning an IP at the firewall.

The engine detects and decides, but never touches the firewall itself. The bouncer puts the blocking rule in place, in nftables or iptables, and the offending IP gets thrown out of your server. You can plug in several (firewall, web reverse proxy) that enforce the same decisions, each at its own level.

Browser exploit

Code that exploits a flaw in a browser, or in an embedded engine, to launch a program on your machine.

A booby-trapped link or message is often all it takes. To prove an exploit works, researchers open the target machine’s calculator: if the calculator opens without authorization, any other program can too.

Browser fingerprinting

Unique fingerprint of your browser, built from technical signals it gives off without knowing it.

Graphics rendering, GPU, installed fonts, resolution, timezone: the combination is enough to recognize you from one site to the next, with no cookie, even in private browsing. Neither a VPN nor a sovereign DNS changes anything, it all plays out in the browser. The counter is client-side: Firefox with arkenfox, Brave, or an extension like CanvasBlocker.

C

C2 (Command and Control)

Attacker’s server that remotely drives infected machines and receives the stolen data.

Blocking outbound connections to known C2 domains, with Little Snitch or LuLu and the IOCs published by researchers, kills the operation even if the malware already ran. These domains are often hacked WordPress sites or brand-new domains, dropped within days to escape the blocklists.

CAPI (Central API, CrowdSec community network)

CrowdSec’s central API, which your engine is enrolled in by default to share and receive malicious IPs.

When you ban an IP, you send up a minimal signal: the address, the scenario, the timestamp, never your logs. In return, you download the aggregated community list and block attackers spotted elsewhere, before they hit you. You can opt out and run purely local.

Captive portal

Web page that appears when you connect to a public Wi-Fi network, to accept terms or identify yourself.

Hotel, café, airport: it’s the mandatory step before reaching the internet. The problem is that an attacker can imitate this portal to harvest your credentials or get you to install malware.

CDHash (Code Directory Hash)

Fingerprint of the part of the signature that lists every page of a binary: it identifies one exact version.

macOS uses it internally to validate a signed executable. In Santa, it is the most precise rule, evaluated first, and the most fragile: the slightest update produces a new CDHash and the rule no longer matches. Keep it for special cases. It is distinct from the SHA-256 of the whole file, another rule type.

See also: Code signing · SigningID · Santa

ClickFix

Scam that shows you a fake error or a fake verification and gets you to paste a command into Terminal.

The line is a curl ... | bash that downloads and runs the malware in one go: you install it yourself. No flaw exploited, the vector is you. The counter fits in one rule: never paste into Terminal a command a web page is pushing you to run.

See also: AMOS · Infostealer · Fileless

Client-side encryption

Your data is encrypted on your device before it leaves, and the provider only receives unreadable content.

It doesn’t hold the keys, so it can’t read anything, even if it wanted to. That is the basis of the zero-knowledge model. Proton Drive works this way. iCloud Drive without ADP and kDrive settle for encryption at rest: the provider encrypts on its server, but keeps the keys.

Client-side scanning

Analysis of the content of a message or a photo directly on your device, before encryption and sending.

The content is compared against a reference database (of child sexual abuse material, for example) and reported to the authorities on a match. End-to-end encryption stays intact during transport, but your message was read before it was encrypted. It is the mechanism at the heart of the CSAR regulation, known as Chat Control 2.0.

CLOUD Act

US law from 2018 that compels American companies to hand over data, even when it is stored outside the United States.

Clarifying Lawful Overseas Use of Data Act. US authorities don’t need to go through international mutual legal assistance. It applies to Gmail, OneDrive or iCloud, whatever your nationality and wherever your data sleeps. A server in Europe with an American provider therefore doesn’t protect you.

CloudKit

Apple’s online sync service, used by iCloud Photos, the Keychain, iMessage and third-party apps.

Since macOS 15.2 Sequoia, Apple also uses it to distribute XProtect signatures. Updates arrive with no notification, usually within 24 to 72 hours.

Coalition Against Stalkerware

International coalition founded in 2019 to help stalkerware victims and coordinate its detection.

It brings together the EFF, Kaspersky, Malwarebytes, Norton, the Centre Hubertine Auclert, WESNET and a dozen other organizations. Its site, stopstalkerware.org, offers multilingual resources (response kits, technical advice, contacts by country). It is the first place to go if you suspect spyware on your phone or a loved one’s.

See also: Stalkerware · iPhone supervision

Code signing

Cryptographic signature applied to software, which guarantees its origin and integrity.

It proves the binary really comes from the stated vendor and that nobody altered it along the way. It doesn’t prove it is harmless: a vendor can sign, entirely by the book, code that does exactly what you don’t want.

See also: Software supply chain · CDHash · TeamID

Configuration profile

A .mobileconfig file that applies a whole set of settings at once to an iPhone, an iPad or a Mac.

Corporate Wi-Fi, VPN, restrictions, certificates, MDM enrollment: it’s legitimate when your employer or your school deploys it. Far less so when someone close to you installs it without your knowledge, with a harmless name (“iOS Update”) and the removalDisallowed flag that stops you from removing it. Check regularly under Settings > General > VPN & Device Management.

See also: MDM · iPhone supervision · Stalkerware

Correlation (SIEM)

The move by which a SIEM links several events to extract a meaning none of them carries alone.

Five denials of the same program in one minute: taken one by one, noise; brought together within a time window, a detection. A correlation rule counts events by ID, by shared field or by machine, and raises a higher alert when the pattern shows up. That’s what separates a crackling dashboard from a SIEM that tells you what to look at.

See also: SIEM · Wazuh vocabulary · Alert fatigue

CRA (Cyber Resilience Act)

European regulation (EU 2024/2847) that imposes cybersecurity requirements on any digital product sold in Europe.

Connected devices, software, firmware, industrial equipment: manufacturers and distributors must maintain the product throughout its lifetime and report exploited vulnerabilities within 24 hours. In force since 10 December 2024, it will be fully applicable on 11 December 2027.

CrowdSec

Open source, self-hosted security engine that reads your logs, spots attacks and blocks offending IPs.

It watches SSH, the web or mail using scenarios, then relies on a bouncer to block, on its own or with the community list. The vendor, a French company founded in 2019, claimed more than 40 million daily signals, sent up from more than 190 countries. The agent is free, the premium lists are paid. It integrates with Wazuh, nginx, Cloudflare or fail2ban.

CSAR (Child Sexual Abuse Regulation)

Proposed European regulation, nicknamed Chat Control 2.0, that aims to make messaging services detect child sexual abuse material.

In its 2022 version, the Commission wanted to impose this detection right inside end-to-end encrypted conversations, which implies client-side scanning on your device. An imposed and acknowledged access, not a clandestine backdoor. In November 2025, the member states dropped mandatory detection in their common position. The text entered trilogue in December 2025 and, at the end of September 2026, six rounds later, no overall agreement had been reached, the scanning of private messages remaining the sticking point. In July 2026, the “voluntary” regime of Chat Control 1.0 was extended until April 2028.

See also: Client-side scanning · Trilogue · NIS2

CTI (Cyber Threat Intelligence)

Threat intelligence: collecting and sharing what is known about attackers to see them coming.

In practice, IP addresses, scenarios, tactics. In CrowdSec, the community CTI feeds the list of malicious IPs you download before your very first attack. You benefit from what others have taken on the chin.

CVE (Common Vulnerabilities and Exposures)

Standardized identifier for a vulnerability, in the format CVE-YYYY-NNNN, referenced by every serious patch.

The catalog is maintained by MITRE, and NIST details it in its NVD database. Every CVE carries a CVSS severity score from 0 to 10 (critical from 9). When a vendor announces a fix without citing a CVE, that’s a signal. You look up the detail on nvd.nist.gov.

Cyber Solidarity Act

European regulation (EU 2025/38), in force since 4 February 2025, that organizes cyber mutual aid between member states.

Shared alerts, an intervention reserve that can be mobilized in a crisis, a common budget. Not to be confused with CSAR: same family of acronyms, opposite subjects. One protects infrastructure, the other set out to read your messages.

D

Daemon

Program that runs in the background, with no window, and starts on its own with the system or your session.

On macOS, launchd manages them. Proton Bridge is one: it decrypts your emails silently, and its menu bar icon is its only visible presence.

Data Privacy Framework (DPF)

EU-US data transfer agreement, adopted in July 2023 to replace the Privacy Shield.

It once again allows personal data to be sent to certified American companies. Its predecessor was struck down by the Schrems II ruling, and it was itself quickly challenged, notably by NOYB. Building your compliance on it means building on ground that is already contested.

See also: Schrems II · FISA 702 · CLOUD Act

Deduplication

Backup technique that stores identical data blocks only once.

Instead of copying everything again on every run, the tool only sends what actually changed. Your off-site storage stays contained and your successive backups are fast. Kopia, restic and Borg do it natively.

Diameter

The 4G signaling protocol, successor to SS7, which reproduces its model of implicit trust.

Same job (roaming, location, authentication between operators) in a more modern syntax. Many networks have not deployed the encryption it provides for, so the location attacks known on SS7 have their Diameter equivalent.

See also: SS7 · Telecom interconnection

DINUM (French government digital agency)

French directorate, reporting to the Prime Minister, in charge of the State’s digital strategy.

In April 2026, it switched its own workstations, about 250, from Windows to Linux, and launched an interministerial plan to reduce dependencies along seven lines, from the workstation to network equipment. Each ministry was to present its roadmap before autumn 2026, a preparation that ultimately concerns some 2.5 million public servants. First concrete step, the State’s sovereign video conferencing tool, Visio, is meant to equip them all. It was one of the most structured sovereignty turns in Europe.

DLP (Data Loss Prevention)

Tools that scan what moves through an organization to block leaks of sensitive information.

Card numbers, personal identifiers, internal secrets: Google Workspace and Microsoft 365 (Purview) run this check server-side. To scan, the provider has to read the content in the clear. A fully end-to-end encrypted workspace therefore cannot run DLP on content. It’s a trade-off, not a flaw.

See also: Vault eDiscovery · KMS · Zero-knowledge

DMA (Digital Markets Act)

European regulation, in force since March 2024, that governs the practices of the very large platforms.

For you, on iPhone, it opens the door to sideloading: installing apps without going through the App Store. If a messaging app like Signal ever had to leave the European App Store, the DMA would make distribution through another channel possible.

See also: Sideloading · Trusted System Agent

DNS

The internet’s directory, which translates a domain name into an IP address.

Domain Name System. Your Mac asks where macsouverain.com is, DNS answers with an address. By default, these queries often travel in the clear, so your ISP sees which sites you visit, even over HTTPS.

See also: DNS resolver · DoH · DNS leak · DNSSEC

DNS leak

Your DNS queries bypass the VPN tunnel and go to your ISP’s resolver, which sees the domains you visit.

A VPN can encrypt all your web traffic and let DNS leak alongside, depending on its configuration. Serious VPNs force every query through their own resolver. You can check on dnsleaktest.com.

See also: VPN · Kill switch · dnscrypt-proxy

DNS resolver (recursive)

DNS server that makes the rounds of the hierarchy for you, then hands you the final address.

Your Mac asks for proton.me: the resolver queries a root server, then the .me server, then the domain’s authoritative server. By default, it’s your ISP’s, which therefore sees everything you ask for. You can replace it with a public resolver (Quad9, Mullvad), a local one (dnscrypt-proxy) or your own (Unbound on a VPS).

See also: Root server · TLD · Authoritative server · Unbound

DNS-over-HTTPS (DoH)

Protocol that encrypts your DNS queries inside ordinary HTTPS traffic, on port 443.

To your ISP or the network admin, your queries blend into the rest of your web browsing. Impossible to read, and hard to isolate. macOS has supported it natively since Big Sur.

DNS-over-TLS (DoT)

Protocol that encrypts your DNS queries inside a dedicated TLS tunnel, on port 853.

At bottom, the same protection as DoH: your queries become unreadable to anyone on the network. The difference is that its dedicated port makes it easy for an administrator to spot and block.

See also: DoH · DNSCrypt · dnscrypt-proxy

DNSCrypt

Protocol created in 2011 that encrypts your DNS queries and authenticates the resolver’s answer.

It stops an attacker from posing as your resolver. Unlike DoH (which goes through HTTPS) and DoT (through a dedicated TLS tunnel), it uses its own format. Many no-logs community resolvers offer it. A client like dnscrypt-proxy speaks all three.

See also: dnscrypt-proxy · DoH · DoT · DNSSEC

dnscrypt-proxy

Open source local service that becomes your Mac’s DNS resolver and encrypts all its queries.

It listens on 127.0.0.1:53, encrypts via DNSCrypt, DoH or DoT, then queries one or more resolvers (Quad9, Mullvad, community ones). It keeps a cache, forces every system query into its tunnel and can filter domains. Install it with brew install dnscrypt-proxy.

See also: DNSCrypt · DNS resolver · DNS leak

DNSSEC

Extensions that sign DNS answers, to prove they really come from the domain’s legitimate server.

Domain Name System Security Extensions. They block cache poisoning and forged answers. DNSSEC encrypts nothing: it guarantees authenticity, encryption is the job of DoH, DoT or DNSCrypt. The domain has to be signed and your resolver has to verify, which Unbound does natively.

See also: Unbound · Authoritative server · DNSCrypt

Docker

Tool that runs applications in isolated containers, on a single server.

Each container carries everything the application needs, code, dependencies and configuration, without stepping on the rest of the system. The result: simpler installs and updates. Many self-hosted services install this way.

See also: VPS · OnlyOffice · User namespace

DORA (Digital Operational Resilience Act)

European regulation (EU 2022/2554) on the digital resilience of the financial sector, applicable since 17 January 2025.

Banks, insurers, asset managers and trading platforms, but also their critical tech providers, must manage IT risk, test their resilience, report incidents and monitor their subcontractors. It overlaps with NIS2 and extends it to suppliers.

E

Easy Switch

Tool built into Proton Mail that imports your emails, contacts and calendars from Gmail, Yahoo or Outlook.

The connection goes through OAuth: you never give your Gmail password to Proton. The import runs in the background and starts from Proton Mail’s settings on the web.

See also: OAuth · vCard · Vendor lock-in

ECH (Encrypted Client Hello)

TLS extension that encrypts the start of the HTTPS connection, the point where your browser still announces the target site in the clear.

Without ECH, a network observer sees the target site, even with encrypted DNS. Chrome, Firefox and Edge support it. At Apple, it is an option each app has to enable, and it is off by default. On the server side, ECH long remained Cloudflare’s business. Since spring 2026, OpenSSL handles it natively, and so does nginx, provided it is compiled with that OpenSSL. Your self-hosted site can therefore enable it, provided it publishes its key in the DNS. Until you do, the site’s name stays readable.

Ed25519

Modern elliptic-curve signature algorithm, used in particular for SSH keys.

Compared with old RSA keys, an Ed25519 key is much shorter, faster to verify, and at least as strong. It is the recommended choice for connecting to a server with a key rather than a password: ssh-keygen -t ed25519.

EDR (Endpoint Detection and Response)

Behavioral antivirus that watches in real time what programs do, not just what they are.

Where classic antivirus compares fingerprints of known files, EDR spots suspicious sequences: file creation, privilege elevation, unusual outbound connection. It therefore holds up better against polymorphic or fileless malware. On a Mac, the free Objective-See tools (KnockKnock, BlockBlock, LuLu, ReiKey) cover a good share of these needs for an individual.

See also: Polymorphic · Fileless · XProtect · Endpoint Security

eIDAS 2.0

European regulation on digital identity, which requires each state to provide its citizens with an identity wallet.

These European Digital Identity Wallets (EUDI) were due to be available by the end of 2026, and very large platforms in the DSA sense must accept them for login. Integrators (Thales, IDEMIA, Entrust) are positioning themselves on the market. A textbook case: regulation creates the need, the market sells the solution.

See also: Identity broker · Age verification

Electron (apps)

Technology that builds desktop apps from web code, by bundling a Chrome engine inside each app.

Discord, Slack, Teams, Notion, VS Code and Spotify are among them. When Chrome fixes a flaw, the Electron app keeps the old version until its own update. An app that rarely updates therefore becomes a prime target with every new Chrome flaw.

Encryption at rest

Encryption of data stored on a server, as opposed to encryption while it travels.

It protects your data if someone walks off with the server’s disks. It says nothing about who holds the keys, and that is the whole question. Gmail encrypts your emails at rest, but Google keeps the keys and can read them. At Proton, every email is encrypted with your key as soon as it arrives, and Proton has no way to read it back.

See also: Client-side encryption · Zero-knowledge · E2EE

End-to-end encryption (E2EE)

Only the sender and the recipient hold the keys to read the content, the service in the middle only sees ciphertext.

The provider (Proton, Signal) technically cannot access your messages, even under a court order. What it still sees is the metadata: who talks to whom, when, how much. And if the content is scanned on your device before being encrypted, the tunnel stays intact but no longer protects anything.

Endpoint Security (macOS system extension framework)

Apple framework, introduced with Catalina in 2019, that lets a security tool follow and block system activity.

Process launches, file opens, volume mounts: some events can be denied before they happen. It runs in user space and replaces the old kernel extensions, where a single bug could crash the whole Mac. It requires a special authorization from Apple on the developer side, then your approval and Full Disk Access on the machine. Santa and most EDRs on the Mac are built on it.

See also: Santa · EDR · Full Disk Access

Enrollment (SIEM agent)

Step where a machine registers with the manager to be monitored.

The agent exchanges a key with the server, on port 1515 with Wazuh, then sends its data on port 1514. Once enrolled, it shows up in the console with a status: Active, Pending, Disconnected or Never connected.

EPS (Events Per Second)

Number of events, log lines, that a SIEM ingests per second: its capacity metric.

A Wazuh node with about 16 GB of RAM and 8 vCPUs handles on the order of 5,000 EPS. When the queue saturates, the SIEM doesn’t slow down: it drops what it has no time to process. A dropped alert is an alert you will never see.

See also: Indexer · vCPU · Wazuh vocabulary

Evil Twin

Fake Wi-Fi access point carrying the same name as a legitimate network, the coffee shop’s or the hotel’s.

Your device connects to it on its own, thinking it has found a known network. The attacker ends up in the middle of your traffic and can watch or tamper with it.

F

Fileless (malware)

Malware that runs in memory without ever writing its full code to disk.

It thus escapes most signature antivirus and leaves very few traces after cleanup. A small script (AppleScript or shell on a Mac) downloads the code and runs it straight in memory. Advanced variant: using Apple-signed tools (osascript, curl, bash) to go unnoticed.

FIM (File Integrity Monitoring)

Integrity monitoring: the SIEM keeps the fingerprint of sensitive files and alerts as soon as one changes.

System binaries, configuration files: modification, creation or deletion triggers an alert. A system file that changes for no reason is often the first sign of an intrusion. In Wazuh, the module is called syscheck and it is on by default.

See also: SCA · Wazuh vocabulary · Wazuh

FISA 702

Section 702 of the US foreign intelligence law, which authorizes the NSA to collect without a warrant.

It is aimed at foreign targets outside the United States, but also sweeps up their correspondents. The NSA can then search this database without a warrant (“backdoor searches”), a practice denounced by the EFF and the Brennan Center. In April 2026, Congress rejected an eighteen-month reauthorization, then settled for short extensions. For lack of agreement, notably on the warrant requirement, Section 702 expired on 12 June 2026. Collection nevertheless continued on the basis of the annual authorizations already issued, valid until March 2027.

See also: Schrems II · CLOUD Act · 5/9/14 Eyes

Forward secrecy

Property that guarantees a key stolen tomorrow cannot decrypt yesterday’s exchanges.

Each session uses ephemeral keys. Even if an attacker records your encrypted traffic today and gets hold of a private key later, the past stays unreadable. Signal implements it through its double ratchet, and MLS brings it to group conversations. It is a property distinct from end-to-end encryption, and a good indicator of cryptographic seriousness.

FSB

Russia’s federal security service, heir to the KGB, which also acts as a software certification authority.

In that capacity, it has access to the source code of software submitted for approval. A vendor that goes down that road doesn’t keep its sources private.

See also: FSTEC · Software supply chain

FSTEC

Russia’s federal service for technical and export control, attached to the Ministry of Defense.

It certifies software intended for government bodies and sensitive infrastructure, and for that it requires the source code to go through accredited laboratories. In other words, the State reads the code before signing off.

Full Disk Access (FDA)

macOS permission that opens all protected files to an application, beyond the access granted case by case.

A security agent shipped as a plain binary, like Wazuh’s, stays blind to sensitive areas until you have granted it. On a managed fleet, it is usually pushed through an MDM profile.

See also: TCC · Endpoint Security · Agent

↑ Back to top

G

GGUF

File format for quantized AI models, popularized by llama.cpp and used by Ollama.

It packs the model’s weights and metadata into a single file, easy to distribute and to load. On a Mac, at equal model and quantization, an MLX version generally runs faster. GGUF keeps the portability advantage: the same file also runs on PC and Linux.

Git

Decentralized version control system, which keeps track of every change to a file.

Every change is recorded, traceable and reversible. Essential for code, configurations or any text-based project. Created by Linus Torvalds, the father of Linux, it is used pretty much everywhere in software development.

Git forge

Web platform that hosts Git repositories and offers an interface to browse code and track issues.

GitHub (Microsoft), GitLab and Gitea are examples. Gitea is lightweight and easy to self-host: your code stays on your machine, not in a giant’s cloud.

Global Title leasing

Leasing to a third party a legitimate address on the global telephone signaling network, a “Global Title”.

For a surveillance company, it is the way in. Through a small complicit operator or a broker, it obtains an access point that lets it query a target’s network remotely, without the consent of the target’s operator.

See also: SS7 · Telecom interconnection

↑ Back to top

H

Harvest now, decrypt later

Strategy of storing encrypted communications today to decrypt them later, with a quantum computer.

The adversary is betting on ten or twenty years. Classical encryption (RSA, elliptic curves) would fall to Shor’s algorithm on a powerful enough quantum machine. If your exchanges must stay secret for a long time, the threat therefore starts now. It is what post-quantum encryption seeks to neutralize.

See also: Post-quantum · Forward secrecy

Homomorphic encryption

Technique that lets a server compute on encrypted data without ever decrypting it.

It is the holy grail of cloud confidentiality, but it remains too computationally expensive at scale. Private Cloud Compute doesn’t use it: it decrypts your text in a hardened, attested enclave. If a cloud AI service promises you confidentiality, that is the question to ask.

HTTPS

Encrypted version of the web protocol, which protects what you exchange with a site.

HyperText Transfer Protocol Secure. Nobody on the network can read the page content or what you type into a form. What stays visible: which site you visit, when and how many times.

See also: SNI · SSL stripping · Metadata

Hugging Face

Community platform where most open AI models are published and downloaded.

Qwen, Mistral, Llama and Gemma are published there, often in several formats and quantization levels. LM Studio or Ollama fetch them from it for you. Careful, being hosted on Hugging Face says nothing about the license: check case by case whether commercial use is allowed.

See also: Open-weight · GGUF · Local LLM

↑ Back to top

I

iCloud Private Relay

iCloud+ service that sends your DNS queries and Safari traffic out through two successive relays.

The first, at Apple, sees your IP but not your destination. The second, at a partner like Cloudflare or Akamai, sees the destination but not your IP. It only covers Safari and a few system services: Chrome, Firefox, Mail and third-party apps stay outside it. Useful as a complement, not as a replacement for a trusted resolver.

Identity broker

Service that verifies your identity on behalf of many sites and apps, by centralizing that verification.

World ID, GOV.UK Wallet and the European EUDI wallets are examples. Along the way, the broker sees each of your interactions with every service plugged into it, and becomes a prime target for hackers and legal orders alike. Mac Souverain’s position is simple: any identity broker that is not zero-knowledge is, by construction, a surveillance point.

See also: World ID · eIDAS 2.0 · Age broker

IMAP

Standard protocol for retrieving email, which syncs your mailbox between the server and all your devices.

Internet Message Access Protocol. Your emails stay on the server, unlike POP3, which downloads and deletes them. You read on your Mac, it’s marked read on your iPhone. Proton Mail uses its own protocol, hence the Bridge, which exposes a local IMAP interface for Apple Mail.

See also: SMTP · IMAP Bridge · Vendor lock-in

IMAP Bridge

Proton software that lets you use Apple Mail, Thunderbird or Outlook with a Proton Mail account.

It installs on your Mac, runs in the background and handles encryption and decryption without you having to think about it. It exposes a local IMAP mailbox and SMTP server, on 127.0.0.1, that your mail client queries like any other server. It is reserved for paid plans; the native Proton Mail app doesn’t need it.

iMessage

Apple’s messaging service, end-to-end encrypted between Apple devices, built into the Messages app on iPhone, iPad and Mac.

Blue bubble, encrypted. The catch: when iMessage drops out, Messages can fall back to SMS, MMS or unencrypted RCS, in the same thread, with only a discreet notice. Turn off the text-message fallback (Send, Resend or Retry as Text Message, depending on the iOS version) and RCS Messaging in Settings > Apps > Messages. Without Advanced Data Protection, if iCloud Backup is on, your backup holds the key to your messages, and Apple can access it.

See also: RCS · SMS / MMS · ADP · Post-quantum

Indexer

SIEM component that files logs into an optimized structure, to search and correlate them fast.

In Wazuh, the indexer, an OpenSearch derivative, is the most RAM-hungry brick. It is what sets the server’s minimum RAM: below 8 GB, it crawls or it stops.

See also: Wazuh · Wazuh vocabulary · EPS

Inference

Running an already trained AI model to produce an answer.

When you ask a local model a question, that is inference, as opposed to the training used to build it. On a Mac, it draws on the CPU, the GPU and the Neural Engine. Locally, it needs no connection and sends nothing outside.

Infostealer

Malware specialized in stealing credentials, session cookies, passwords and crypto wallets.

The data goes to a C2 server, then gets resold on underground marketplaces. On the Mac, the most recent ones (MacSync, AMOS, Banshee) bet on manipulation rather than on a flaw: you are the one who runs the code, after following booby-trapped instructions.

See also: AMOS · ClickFix · Bearer token

Integrator (integratord)

Wazuh daemon that pushes every alert above a threshold to an external channel: chat, webhook or script.

It is configured in ossec.conf, one <integration> block per channel, each with its own threshold on the 0 to 16 scale. Email notifications, for their part, are handled directly by the manager. It is the brick that turns a SIEM that detects into a SIEM that warns you.

See also: Wazuh · Alert fatigue · Active response

International mutual legal assistance

Procedure by which one State asks another to help it in an investigation, for example to obtain data.

It is far slower and more tightly framed than a domestic order. That is what protects data hosted in Switzerland: a foreign government cannot demand access directly, it has to go through a Swiss judge. The CLOUD Act exists precisely to short-circuit that step.

IOC (Indicator of Compromise)

Verifiable technical clue that proves or suggests a machine has been compromised.

C2 domains, SHA-256 hashes of malicious binaries, download URLs, IPs of exfiltration servers. Researchers publish them so everyone can block or detect quickly, for example in Little Snitch. They age badly: attackers change infrastructure every few days.

IPA (Investigatory Powers Act)

British law of 2016 on the State’s surveillance powers, nicknamed the “Snoopers’ Charter”.

It is what authorizes Technical Capability Notices and imposes silence around their issuance. It acts by secret national injunction, not by public legislative debate.

See also: TCN · IPT · Online Safety Act

iPhone supervision

Administration mode for an iPhone, via Apple Configurator or an MDM, that grants wider rights than a standard MDM enrollment.

The administrator can forbid removing the profile, restrict hardware, control apps. Legitimate in a company or at school, this mode gets diverted at home: someone close to you who gets hold of your iPhone can supervise it with a cable and a Mac, at the cost of a wipe followed by a restore of your backup. To check, open Settings: the line “This iPhone is supervised” appears at the top if that is the case.

See also: MDM · Configuration profile · Stalkerware

IPT (Investigatory Powers Tribunal)

Specialized British court that hears challenges against the surveillance powers of the Investigatory Powers Act.

It is before this court that Apple challenged, in March 2025, the TCN targeting its iCloud backups, then, in 2026, a new TCN limited to British users. In September 2026, Apple’s challenge still concerned the secrecy of these notices, not the substance. Privacy International and Liberty are challenging the very regime of these notices there.

ISO 27001

International standard that frames an organization’s information security management system.

A certified host has had its risk, access and incident management procedures audited by an independent body. That doesn’t prove it is impregnable. It proves that a structured security approach exists and that it is checked regularly.

ISP

Internet service provider: the company that connects you to the network, Orange, Free, SFR, Swisscom.

It sees all your traffic go by, and therefore its metadata: at what time, to which servers, in what volume. It is also the one that gives you your default DNS resolver, unless you change it.

K

kDrive

Online storage service from Infomaniak, a Swiss host based in Geneva, with 15 GB free.

Datacenters in Switzerland, Swiss jurisdiction, mounting in the Finder via WebDAV, OnlyOffice built in to co-edit documents. Careful: kDrive encrypts at rest and in transit, but not client-side. Infomaniak holds the keys.

See also: Encryption at rest · WebDAV · nLPD

Kill switch

VPN feature that cuts your internet connection if the tunnel drops.

Without it, a VPN disconnection sends your traffic back onto the network in the clear, until you notice. With it, nothing gets out, not even for a second.

KIP (Kernel Integrity Protection)

Apple Silicon hardware protection that forbids any modification of the running macOS kernel, even with root rights.

The processor write-locks the kernel code in memory. A whole family of attacks, which consisted of injecting code into the kernel of a running Mac, becomes impossible by construction.

KMS (Key Management Service)

Big cloud providers’ service for storing, rotating and auditing the keys that encrypt an organization’s data.

Two models: the provider keeps the key, or the organization keeps it and lends it to the service (CMEK, BYOK, HYOK). Google Workspace thus offers client-side encryption with an external KMS: the key stays outside Google, which cannot deliver the content in the clear. The price: search, DLP and preview no longer work on that content.

See also: Client-side encryption · DLP · CLOUD Act

Kopia

Open source backup tool that encrypts your data on your machine before sending it to remote storage.

It deduplicates to limit the volume transferred and writes to S3-compatible storage, from sovereign cloud to NAS. The key stays with you: the host cannot read what it stores. The accepted flip side: losing that key makes your backups unreadable for you too.

See also: Deduplication · 3-2-1-1 rule · S3

↑ Back to top

L

Linked device

Computer, tablet or second phone attached to your Signal or WhatsApp account, which receives your messages with its own encryption keys.

Each linked device is a legitimate “end” of the conversation: adding one means adding a recipient, without breaking the encryption. Linking goes through a QR code scanned with your phone, or on WhatsApp through a linking code shown on the computer then entered on the phone. A linked intruder reads everything, encryption intact, like a copy of your mailbox key. Only scan a QR code or enter a code if it shows on your own computer, and check your linked devices list often.

Local LLM

Large language model that runs on your machine rather than on a provider’s servers.

No request goes out on the network, no data leaves your computer, and the tool works even offline or if a provider cuts off your access. On a Mac, Apple Silicon’s unified memory is what makes this possible on a consumer machine.

Lockdown (Santa mode)

Santa mode in which any binary that matches no allow rule is refused.

It is the target of a deployment, reached after a period in Monitor to inventory what actually runs. It is enabled through a configuration profile (ClientMode set to 2), never through defaults write, which Santa ignores so that malware cannot free itself. Nothing to do with Apple’s Lockdown Mode, which restricts the device against state spyware. Same word, two mechanisms.

See also: Santa · Allowlisting · Configuration profile

↑ Back to top

M

MAID (Mobile Advertising Identifier)

Unique advertising identifier assigned to your phone by its system, IDFA on iOS, GAID on Android.

It lets advertisers and data brokers follow you from app to app to build your profile. You can reset it in Settings > Privacy & Security > Tracking: the link with your history is cut, but nothing is erased from the databases already built.

Malvertising

Spreading malware through sponsored ads bought on legitimate ad networks.

The attacker bids on a popular keyword, often the name of a piece of software, and the ad points to a booby-trapped install page. Very effective, because you are precisely trying to install something and you lower your guard.

Man-in-the-middle (MITM)

Attack where a third party slips in between you and the server to read or alter your exchanges.

A classic on poorly secured public Wi-Fi. A fake access point or a connection downgraded to HTTP are two common ways to get in the middle.

See also: Evil Twin · SSL stripping · Captive portal

Matrix

Open, decentralized protocol for messaging, calls and file sharing, end-to-end encrypted.

Unlike Slack or WhatsApp, Matrix is federated: you can host your own server and chat with users on other servers. Synapse is the reference server, Element the most common client.

MCP (Model Context Protocol)

Protocol published by Anthropic in November 2024 to plug tools and data into a language model.

It is what lets Claude Desktop, Cursor or Windsurf read your files, query a database or run a command. It rests on two interfaces, STDIO (local process) and HTTP. In April 2026, OX Security documented the STDIO interface, shipped without isolation, as an attack vector, and estimated up to 200,000 exposed servers. Anthropic replied that this was intended behavior.

MDM (Mobile Device Management)

Remote management of Apple devices, designed for corporate fleets and school deployments.

An MDM profile gives the administrator extensive rights: enforce a passcode, restrict apps, read the inventory, sometimes install or remove apps. In a company, it’s legitimate. At home, it has become the main vector for stalkerware on iPhone. Check under Settings > General > VPN & Device Management.

Mesh network

Network where each device connects directly to the others, without going through a central server.

If one node goes down, the others keep talking. Tailscale builds this kind of network, encrypted with WireGuard, between all your devices.

Metadata

Data about data: who, when, where, how much, but not the content.

For an email: sender, recipient, time, IP address. For your browsing: which sites, at what time, how often. A regular call to a specialized lawyer often says more than the conversation itself. End-to-end encryption protects the content, not the metadata.

MFA (Multi-Factor Authentication)

Authentication that requires at least two proofs of identity: password plus a code, a hardware key or biometrics.

A stolen password is no longer enough to get in. NIS2 makes it mandatory for the entities it covers. Its limit: it protects the moment of sign-in, not the token handed over afterwards.

See also: Bearer token · OAuth consent phishing · NIS2

MIE (Memory Integrity Enforcement)

Kernel memory protection etched into the A19 and M5 chips, which blocks memory corruption in hardware.

It builds on MTE: every allocation receives a secret tag, and the processor refuses any access whose tag does not match. It targets the families of bugs (use-after-free, buffer overflow) behind the majority of kernel exploits on macOS and iOS. In May 2026, Calif announced a first public bypass on an M5 Mac, a kernel exploit chain tested under macOS Tahoe 26.4.1. Apple fixed in macOS Tahoe 26.5 a kernel flaw reported by Calif, without it being known whether this fix covered the whole chain.

MLS (Messaging Layer Security)

End-to-end encryption protocol for group conversations, standardized by the IETF (RFC 9420).

It handles participants joining and leaving without compromising past or future exchanges. Proton Meet used it from its launch, on 31 March 2026. In May 2026, Apple and Google launched, in beta with iOS 26.5, end-to-end encryption of RCS between iPhone and Android, on a GSMA standard that builds on MLS.

See also: Signal Protocol · Forward secrecy · Matrix

MTE (Memory Tagging Extension)

Hardware extension of the ARM v9 architecture that tags memory to detect illegitimate access.

The processor assigns a 4-bit tag to every 16-byte block, and the same tag is carried by the pointers that access it. At the slightest mismatch, exception. The A19 and M5 chips offer its first serious consumer implementation, the foundation of MIE.

N

NEFilterDataProvider (Network Extension)

Apple framework, introduced with Big Sur, that outbound firewalls use to filter the network without a kernel extension.

Little Snitch and LuLu thus run in user space: no more kernel panic caused by a third-party driver, mandatory Apple signature, strict isolation. Practical limit: only one filter of this type can be active at a time. Little Snitch and LuLu together is impossible.

Neural Engine

Apple Silicon coprocessor dedicated to machine learning computation.

Alongside the GPU and the CPU, it runs the on-device Apple Intelligence model, around 3 billion parameters, without any data leaving the chip. It is the pillar of Apple’s privacy promise within the local perimeter.

NIS2 (Network and Information Security 2)

European cybersecurity directive, which entered into force in January 2023, that sharply widens the number of entities covered.

In France, about 15,000 to 18,000 entities against 500 under NIS1: above 50 employees and 10 million euros in revenue in the covered sectors. Article 21 requires encryption, MFA and secure communications, Article 20 makes executives liable. In October 2026, France had still not transposed it, despite a deadline set for October 2024, and the Commission had referred it to the Court of Justice of the EU in July. The “Résilience” bill, passed by the Senate in March 2025, was due to reach the floor of the National Assembly on 7 October 2026, before being withdrawn from the agenda the day before.

nLPD (Swiss FADP, revised Federal Act on Data Protection)

Swiss personal data protection law, revised and in force since September 2023.

Close to the GDPR in its principles (consent, transparency, right of access), but legally distinct. Proton and Infomaniak are subject to it, and also comply with the GDPR, which reaches beyond the EU whenever European residents’ data is involved.

No-logs

A VPN provider’s promise to keep no record of your connections.

Sites visited, times, IP addresses: supposedly, nothing is kept. A promise costs nothing. It is only worth something if an independent audit has verified it.

npm (Node Package Manager)

Central registry of the JavaScript ecosystem, from which developers download their packages with npm install.

It is a historically fragile link in the supply chain. A single compromised package can reach millions of machines within hours, since it installs everywhere it is declared as a dependency.

NSL (National Security Law, Hong Kong)

National security law imposed on Hong Kong by Beijing on 30 June 2020.

Since an amendment to its implementing rules on 23 March 2026, police can demand a suspect’s passwords and encryption keys, and refusing is a criminal offense. It is a direct compulsion to hand over keys, where other regimes obtain access by roundabout routes.

O

OAuth

Protocol that lets an application access your data on another service without knowing your password.

Open Authorization. You give your consent in a window from the original service (Google, Apple), which hands the app a token limited in time and scope. That’s what Proton Easy Switch uses to read your Gmail mailbox: you authenticate with Google, and Proton never sees your password. The flip side: a token granted to the wrong app is as good as a stolen password.

Scam that gets you to authorize a rigged app on a genuine Google or Microsoft sign-in screen.

You click “Allow”, the app receives an access token to your mailbox and your files, without ever stealing your password. Two-factor is useless, and changing your password cuts nothing off. The token lives until you remove the app’s access in your account’s security settings. In September 2026, the FBI warned about this technique.

Ollama / LM Studio / MLX

Three ways to run an AI model locally on a Mac.

Ollama is a command-line tool that downloads and starts a model in one command. LM Studio is a graphical app for discovering and testing models without Terminal. MLX is Apple’s framework, more technical but the fastest on Apple Silicon. In all three cases, no data leaves your machine.

See also: Local LLM · GGUF · Hugging Face

Online Safety Act (UK)

British law of 2023, overseen by Ofcom, whose child protection part has applied since 25 July 2025.

It requires platforms, adult sites and some social networks included, to carry out robust age verification. In early 2026, Ofcom issued fine after fine, including £1.35M for 8579 LLC in February and £520,000 in total for 4chan in March. In March 2026, the ICO and Ofcom made clear that self-declaration alone is not enough.

See also: Age verification · Age broker · IPA

OnlyOffice

Open source office suite (AGPLv3) for documents, spreadsheets and presentations, with real-time co-editing.

It reads and writes Microsoft formats natively and integrates with kDrive or ownCloud. It can be self-hosted via Docker. It lets you co-edit documents without Google or Microsoft, provided you accept a few missing features compared with the most advanced proprietary suites.

See also: kDrive · Docker · Vendor lock-in

Open source

Software whose source code is public and can be examined by anyone.

Independent researchers can check it for backdoors or hidden flaws, without asking the vendor for permission. You don’t have to take the vendor’s word for it: others have been able to look.

Open-weight

AI model whose weights are published and freely downloadable.

You can grab it, run it at home, modify it. But open-weight is not open source: the training data and code most often stay closed. That’s what separates a Mistral or a GLM, which you run locally, from a GPT or a Claude, reachable only through the provider’s API.

See also: Open source · Hugging Face · Parameters

OpenPGP

Open end-to-end encryption standard for email, defined by RFC 4880 and then RFC 9580.

Everyone has a private key, kept to themselves, and a public key, shared. Any compatible client (Proton Mail, Thunderbird, GnuPG, Mailvelope) reads and writes OpenPGP, the opposite of a protocol locked inside a single app. In June 2026, the IETF published its post-quantum extension, RFC 9980.

See also: S/MIME · Post-quantum · E2EE

↑ Back to top

P

PAC (Pointer Authentication Codes)

Apple Silicon hardware mechanism that signs every function pointer and checks the signature before using it.

If someone has altered a pointer to divert execution to malicious code, the check fails and nothing happens. ROP and JOP attacks, two very widespread exploitation techniques, thus become much harder.

Page cache

Area of RAM where the kernel keeps a copy of recently read files, to avoid reading the disk again.

A program launched several times is served from that cache. Corrupting the cache therefore amounts to changing what the system believes it is running, without ever touching the file sitting on disk. An integrity check that only looks at the disk sees nothing go by.

Parameters (model weights)

The numerical values learned during an AI model’s training, which encode everything it “knows”.

They are counted in billions (3B, 7B, 32B, 70B). The more there are, the more capable the model, and the more memory it eats. Their number, combined with the quantization level, gives the size of the file to load, and so whether or not it fits on your machine.

See also: Quantization · Unified memory · Open-weight

Polymorphic (malware)

Malware that rewrites itself with every distribution, with a different fingerprint for each victim.

Blocklists based on SHA-256 hashes become useless, and signature detection struggles. Behavioral tools, which look at what the code does rather than what it is, stay effective.

Post-quantum (encryption)

Encryption algorithms designed to withstand a future quantum computer powerful enough to break RSA and elliptic curves.

In August 2024, NIST standardized ML-KEM (derived from Kyber) for key exchange and ML-DSA for signatures. 2026 deployments were mostly hybrid: a proven classical algorithm plus a recent post-quantum one. iMessage adopted it in March 2024 (PQ3), Signal in September 2023, Tuta in March 2024, and Proton Mail began rolling it out in May 2026. The goal: defuse “harvest now, decrypt later”.

Private Cloud Compute (PCC)

Apple’s cloud infrastructure that handles the Apple Intelligence requests too heavy for the device.

Apple promises five technical guarantees there: nothing is kept after the request, protections enforced by engineering rather than by contract, no privileged access, no way to target a user, and code published in a verifiable log. It is the most auditable cloud AI offering on the consumer market. But it is not end-to-end encryption: your text is decrypted at Apple for the duration of the computation.

Privilege escalation and lateral movement

The two acts that follow an intrusion: gaining administrator rights, then moving from machine to machine.

Escalation exploits a flaw or a badly set permission. Lateral movement reuses the credentials picked up along the way to advance through the network. An attacker rarely gets in right where the thing they want sits: they come in through the weak link, then work their way up. The first intrusion matters less than what it lets them reach afterwards.

See also: RCE · User namespace · Seccomp

Process-aware outbound firewall

Firewall that intercepts outbound connections and decides, app by app and destination by destination, whether to let them through.

Where a classic firewall sees “outbound HTTPS traffic”, this one knows it’s Photos talking to apple.com. On a Mac, two tools dominate: Little Snitch (Objective Development, paid, closed source, Austrian) and LuLu (Objective-See, free, open source, American). It complements ALF, which filters inbound traffic, and Santa, which controls execution: three independent layers.

See also: ALF · NEFilterDataProvider · Santa · C2

Pull request (PR)

Proposed change to the code of a project hosted on a forge like GitHub, which the maintainer reviews, then accepts or rejects.

It is the social pillar of modern open source. Misconfigured, with an overly permissive pull_request_target workflow, a malicious PR can run code with the target repository’s privileges, an increasingly common supply chain attack vector.

See also: Git forge · Supply chain attack · Git

↑ Back to top

Q

Quantization

Compressing an AI model by reducing the precision of its weights, for example from 16 to 4 bits.

The model takes far less memory and runs faster, for a quality loss that is often imperceptible. That’s what fits a 24 or 32 billion parameter model into a consumer Mac (“Q4” means 4 bits per weight). A variant, QAT (Quantization-Aware Training), prepares the model for it from training onward: Apple Intelligence thus goes down to 2 bits per weight, about 1 GB.

See also: Parameters · GGUF · Local LLM

↑ Back to top

R

Ransomware

Malware that encrypts your data, sometimes your backups, then demands a ransom for the key.

Modern variants practice double extortion: they also steal the data and threaten to publish it. The whole post-incident ecosystem (negotiators, insurers, firms) often has an interest in you paying. Your only reliable defense is prepared beforehand: encrypted backups following the 3-2-1-1 rule, a segmented network, a response procedure written in advance.

See also: 3-2-1-1 rule · Kopia · Allowlisting

RCE (Remote Code Execution)

Flaw that lets an attacker run the code of their choice on your machine, remotely.

It is the most serious class, because it opens everything: file theft, keylogger, full takeover, pivoting across the network. It can be “zero-click”, with no action on your part, like Pegasus on iMessage, or require a gesture: opening a page, a file.

RCS (Rich Communication Services)

SMS successor standardized by the GSMA and provided by carriers: read receipts, good-quality photos, real group chats.

Apple opened it on the iPhone in September 2024, with iOS 18. Between iPhone and Android, it long stayed without end-to-end encryption, readable on the server side. In May 2026, iOS 26.5 launched encrypted RCS in beta, on a GSMA standard that builds on MLS, provided carriers follow. In October 2026, no French carrier encrypted it on iPhone yet: with them, RCS still went out without end-to-end encryption, readable by the carrier.

See also: MLS · End-to-end encryption · SMS / MMS · iMessage

Registration Lock and two-step verification

Signal (Registration Lock) and WhatsApp (two-step verification) settings that require a secret code to re-register your number on another phone.

Without them, an intercepted or extorted SMS code is enough to re-register your number elsewhere and write in your name. Signal asks for your Signal PIN, and its lock lapses after seven days of inactivity. WhatsApp used to ask for a six-digit PIN, and in late August 2026 began gradually offering a real password as an alternative. Both are turned on in each app’s account settings and protect re-registration of your number, while linking a device goes through your phone: check your linked devices list too.

See also: Linked device · SMS / MMS · MFA

Root server

One of the thirteen logical entry points of the global DNS hierarchy, named A to M.

It is the first port of call for a resolver that doesn’t have the answer in cache. It never gives a site’s address, it only says which TLD server to ask next. They are run by different organizations (IANA, Verisign, RIPE NCC) and replicated across hundreds of sites worldwide.

ROP / JOP (Return-Oriented Programming / Jump-Oriented Programming)

Exploitation techniques that recycle fragments of legitimate code already in memory into a malicious sequence.

The attacker injects nothing new: they chain existing “gadgets”. That’s how they used to get around the protections that forbid executing data. On Apple Silicon, PAC makes these attacks much harder.

Rspamd

Fast open source anti-spam and anti-phishing filter, found in the reference self-hosted mail servers.

Mailcow, Zimbra and Mailu bundle it. It combines Bayesian filtering, reputation lists, DKIM, SPF and DMARC checks, neural networks and custom rules. In front of a small business mail server, it intercepts the number one intrusion vector, phishing, and its logs plug straight into Wazuh.

RTB (Real-Time Bidding)

Real-time ad auctions, triggered every time an ad is shown in an app or on a site.

Within a few milliseconds, dozens of buyers receive your data (advertising identifier, IP, approximate location, profile) to bid. All of them receive it, whether they win the auction or not. Companies like Webloc (Penlink) mine these streams for warrantless geographic surveillance.

S

S/MIME

Email encryption and signing standard, based on certificates issued by central authorities.

Secure/Multipurpose Internet Mail Extensions. It has historically dominated in companies and government (Microsoft 365, Google Workspace as a paid option). It signs and encrypts like OpenPGP, but rests on a hierarchy of certificate authorities where OpenPGP relies on a peer-to-peer web of trust. The two don’t talk to each other.

S3 (object storage)

Online storage standard invented by Amazon that became a universal protocol.

Data is stored as “objects” in “buckets”, reachable through a web API. Many providers are compatible (Infomaniak Swiss Backup, Backblaze B2, Scaleway): you change host without changing backup tool.

Santa

Open source execution control tool for macOS, which decides which programs are allowed to start.

Three modes: Monitor (everything runs, everything is logged), Lockdown (only what is allowed runs) and Standalone (the unknown waits for your go-ahead). Its rules range from the most precise to the broadest (CDHash, SHA-256, SigningID, certificate, TeamID), and the first match wins. Created at Google in 2014, it is maintained by North Pole Security. In Lockdown, ransomware downloaded by mistake doesn’t start, because it is not on the list. Its execution log is set by EventLogType in the configuration profile: file, the most stable, in key=value lines that Wazuh reads with a small custom decoder, or json, read directly but flagged BETA.

SCA (Security Configuration Assessment)

Wazuh configuration audit module, on by default, that compares your machines against the CIS hardening benchmarks.

Check by check, it lists what is compliant and what isn’t: one service too many, a permission that’s too broad, a forgotten SSH setting. You get a score and the list of gaps to fix, without installing anything beyond the agent.

Schrems II

Court of Justice of the EU ruling of 16 July 2020, which struck down the Privacy Shield between the EU and the United States.

The Court held US surveillance (FISA 702, Executive Order 12333) incompatible with European fundamental rights. Storing European residents’ data with an American company without additional measures therefore creates a GDPR compliance problem. The Data Privacy Framework partially replaced it in 2023.

See also: Data Privacy Framework · FISA 702 · CLOUD Act

SDK (Software Development Kit)

Toolkit a developer drops into an app to add a feature without coding it themselves.

Analytics, advertising, mapping: many legitimate apps (weather, sports, dating) embed advertising SDKs that can collect your location and resell it, whatever the app’s own policy. You grant the location permission to the app, not to the SDK living inside it.

See also: RTB · ATT · MAID · Telemetry

SDP (Stolen Device Protection)

iOS protection that requires Face ID or Touch ID for sensitive actions when your iPhone is away from home.

Changing your Apple Account password or turning SDP itself off: the iPhone passcode is no longer enough away from your familiar places. A thief who watched you type your passcode therefore can’t lock you out of your account. Since iOS 26.4, Apple turns it on by default on personal iPhones, and on corporate devices with iOS 26.4.1.

Seccomp

Linux kernel filter that limits the system calls a process is allowed to use.

Tuned properly, it turns an exploitable flaw into a dead end. The hostile code runs, but the call it needs to go any further is denied.

SecNumCloud

ANSSI qualification reserved for clouds able to host the French State’s most sensitive data.

Three pillars: strong technical security, immunity from extraterritorial laws like the CLOUD Act, European governance (capital, head office, staff). In practice, it rules out AWS, Azure and GCP, even through their European subsidiaries. Qualified providers: OVHcloud, Outscale, Numspot, Cloud Temple.

See also: ANSSI · CLOUD Act · ISO 27001

SecretAgent

Small background program installed by Secretive, which answers SSH when it looks for a key.

It gets the Secure Enclave to sign after your Touch ID. It replaces the usual macOS SSH agent, hence the unusual socket path to set in your SSH configuration.

Secretive

Open source Mac app that creates your SSH keys in the Secure Enclave, which they never leave.

The key cannot be copied. On every SSH connection, the app asks for Touch ID before signing. Malware rummaging through your files finds no key to steal. The Secure Enclave only handles ECDSA P-256 keys, not Ed25519.

See also: SecretAgent · Secure Enclave · Ed25519

Secure Enclave

Isolated coprocessor in every Apple Silicon chip, which guards your keys and does the computing in their place.

It has its own memory, its own microkernel and its own AES engine. It holds Touch ID data, FileVault keys and Apple Pay secrets. It never hands a key to the system: it signs or decrypts on request, without exposing it. “Use this key for me”, never “give it to me”.

Server-side tracking

Tracking where your browser sends its data to an intermediate server, which then forwards it itself to ad platforms and analytics tools.

From your Mac, the tracking data only goes to a single domain, often the service’s own or one it controls. The transfers to ad platforms then go server to server, out of reach of your browser and of blocklists that don’t know this relay. Your outbound firewall can still target the relay’s domain if it differs from the site’s, once spotted in the network monitor. What leaves it afterwards, on the other hand, is completely beyond you.

Sideloading

Installing an app without going through the official store, App Store or Play Store.

On Android, it has always been possible with an APK file. On iPhone, the DMA has allowed it in Europe since March 2024, through alternative stores. Signal could thus distribute its app outside the App Store if it ever had to leave the European market.

SIEM (Security Information and Event Management)

System that centralizes the logs of all your machines, spots abnormal behavior and raises alerts.

Servers, firewalls, workstations, mail: everything goes up to the same place, in a usable format. It is the brick that lets you meet the notification deadlines of the GDPR (72 hours) and NIS2 (early warning within 24 hours). The SaaS leaders (Splunk, Microsoft Sentinel, CrowdStrike) are subject to the CLOUD Act. On the open source, sovereign side: Wazuh, backed by CrowdSec, Rspamd and Santa.

See also: Wazuh · Correlation · Agent · Alert fatigue

Signal Protocol

Open source end-to-end encryption protocol, distinct from the Signal app that uses it.

It combines the X3DH key exchange and the double ratchet, which renews the keys with every message. If an attacker recovers a session key at a given moment, they can read neither past nor future messages. WhatsApp uses it too, but remains a proprietary app that collects metadata.

See also: Forward secrecy · MLS · Metadata

SigningID (signing identifier)

Identifier written into a binary’s signature, most often the app identifier (com.vendor.app).

It designates one specific application and holds from one version to the next. Since any developer could reuse that name, Santa always prefixes it with the vendor’s TeamID, or with platform for Apple’s binaries. It’s the right level for allowing a single app from a vendor without writing them a blank check.

SIMjacker

Attack that sends an invisible SMS to certain SIM cards to run hidden commands on them.

It exploits a piece of software present on those cards, the S@T Browser. The message never appears on screen, but can for example retrieve your location and send it back to the attacker. Unlike SS7 attacks, which target the network, it hits your SIM card directly.

SIP (System Integrity Protection)

macOS protection that stops any program, even root, from modifying critical system files.

It covers in particular /System and /usr (except /usr/local). Disabling it requires a reboot into Recovery mode and the csrutil disable command. Apple turns it back on after every major update.

SMS / MMS

Mobile network text (SMS) and multimedia (MMS) messages, carried by the carrier without any end-to-end encryption.

Short Message Service and Multimedia Messaging Service. Your carrier can read their content, and anyone with access to the signalling network can intercept SMS. Sign-in codes sent by SMS inherit this: a SIM swap or an SS7 attack is enough to divert them. On iPhone, Messages uses them as a fallback when iMessage or RCS drops out: turn off the text-message fallback and MMS Messaging if you want to stay in control.

See also: SS7 · SIMjacker · RCS · MFA

SMTP

Standard protocol for sending email.

Simple Mail Transfer Protocol. When you click “Send”, it is what carries the message to the outgoing server. Proton Bridge exposes a local SMTP server on 127.0.0.1, port 1025: Apple Mail drops the email there, Bridge encrypts it and passes it on to Proton.

SNI (Server Name Indication)

TLS extension through which your browser announces, in the clear, the domain it wants to reach.

It is essential for servers hosting several sites on the same IP address. But since the announcement goes out in the clear on most connections, a network observer knows where you are going, even with encrypted DNS. The answer being rolled out is called ECH.

SOC 2 Type II

Security audit defined by the AICPA, which verifies that an organization’s controls work over time.

It covers five criteria: security, availability, processing integrity, confidentiality, privacy. “Type II” means the audit covers an observation period, usually 6 to 12 months, not a snapshot at a single moment. The procedures aren’t just written down, they run. Proton AG has been SOC 2 Type II audited since 2023.

SoC (System on a Chip)

Chip that brings together processor, GPU, Neural Engine and Secure Enclave, with memory in the same package.

Apple Silicon (M1 and later) is a SoC. On the security side, components no longer talk over exposed physical buses, and storage encryption goes through a built-in AES engine.

See also: Secure Enclave · Unified memory · T2

Software supply chain

The whole path a piece of software takes to reach your machine: who writes it, who compiles it, who signs it, who pushes the update.

That path is not the same thing as the address where the vendor is incorporated. Software published by a European company can be written or signed elsewhere. It is this chain, as much as the company register, that tells you who you are really trusting.

See also: Supply chain attack · Code signing · npm

SS7 (Signalling System 7)

Protocol suite that lets telephone operators worldwide route calls and texts and handle roaming.

Designed in the 1970s for a handful of operators who trusted each other, it has no serious authentication. A third party who gets access to the signaling network can locate a phone or intercept its texts, anywhere in the world, without touching the device. It is used in 2G and 3G, and Diameter, in 4G, inherits the same weaknesses.

SSL stripping

Attack that forces your connection to stay on unencrypted HTTP instead of switching to HTTPS.

The attacker intercepts the initial request. The site thinks it is talking securely, so do you, and the attacker reads everything in the clear in the middle.

Stalkerware

Consumer spyware installed covertly on a loved one’s phone to read their messages and track their location.

It targets a spouse, an ex, an adult child. Nothing to do with Pegasus: the buyer is an individual paying between thirty and a hundred dollars a month, and installation takes physical access to the phone. On iPhone, the dominant vector is a disguised MDM profile, installed via Apple Configurator, at the cost of a wipe if the device has to be supervised. On Android, an app hidden behind a system-sounding name.

Supply chain attack

Attack that reaches its target through a trusted intermediary, typically a widely used open source package.

The attacker compromises the weak link (a misconfigured build pipeline, an isolated maintainer, an abandoned dependency), and the rigged code flows down to every user as legitimate. Example: in May 2026, the TanStack JavaScript ecosystem saw 84 rigged versions published across 42 packages, as part of the Mini Shai-Hulud campaign, which hit more than 170 npm and PyPI packages. Those packages carried a valid provenance attestation, because it was the legitimate publishing pipeline that had been hijacked.

See also: Software supply chain · npm · Pull request · Code signing

↑ Back to top

T

T2 (Apple security chip)

Security chip in Intel Macs from 2018 to 2020, which handled the Secure Enclave, Touch ID, FileVault and secure boot.

With Apple Silicon, from the M1 in 2020, these functions were built directly into the main chip. The T2 no longer exists as a separate component.

Tailscale

Service that links all your devices into an encrypted private network, on top of WireGuard.

Your machines see each other through private addresses, as if on the same local network, when they are scattered between a datacenter, your office and your home. The rest of the internet sees nothing. In practice, you pull SSH off your server’s public IP and expose it only on this network: internet scans no longer find it.

See also: Mesh network · WireGuard · VPS

macOS permission system that asks for your consent before an app touches your sensitive data.

Photos, contacts, microphone, camera, location: without your “Allow”, no access. But TCC doesn’t see everything. When you open a file through the file picker, drag and drop or a double-click, a second mechanism, com.apple.macl, grants lasting access, invisible in System Settings > Privacy & Security.

See also: Full Disk Access · xattr · SIP

TCN (Technical Capability Notice)

Secret British government order that forces a company to build itself a way into data, even encrypted data.

Issued under the Investigatory Powers Act, it is covered by legal secrecy: neither the company nor the government is allowed to publicly confirm that it exists. It is the tool London used to go after Apple’s encrypted iCloud backups.

TeamID (Apple Developer team identifier)

Ten-character identifier Apple assigns to every developer account, written into everything it signs.

It stays stable from one app to the next and one update to the next, even when the vendor changes certificate. In Santa, a TeamID rule allows all of its apps in one go and survives updates best. The flip side: you trust its whole catalog, present and future. You read it with codesign -dv.

Telecom interconnection

All the links that let the networks of different operators talk to each other.

It is what gets your call through to someone with another operator, in another country. It is also what SS7 or Diameter attacks exploit: the flaw is not in your phone, but in the trust these networks extend to one another.

See also: SS7 · Diameter · Global Title leasing

Telemetry

Data an app or a system sends its vendor about how it runs: crashes, performance, usage.

Some of it genuinely helps fix bugs. But the word also covers third-party measurement, support or crash-reporting services, which pick up identifiers along the way, sometimes your email or the address of the pages you view. Essential for the vendor doesn’t mean necessary for the app to work. Turn off the switches in the settings first, then check in your outbound firewall who the app really talks to.

See also: Tracker · Process-aware outbound firewall · SDK · Blocklist

Template injection

Flaw that hijacks a template engine to make it execute instructions rather than display text.

The engine assembles a page or a configuration file from a template and variables. If the application inserts a user-supplied value without neutralizing it, the attacker slips in instructions that the server dutifully executes. The outcome ranges from leaking internal variables to remote code execution.

TLD (Top-Level Domain)

Last level of a domain name, after the final dot: .com, .org, .fr, .eu, .me.

Each is run by an organization (Verisign for .com, AFNIC for .fr, EURid for .eu) that maintains its DNS servers. When a resolver asks a root server for proton.me, the root answers “ask .me”, which in turn points to the servers for proton.me.

Tracker

Script, pixel or third-party service built into a site or an app, which passes on to someone else what you do there.

Ad network, audience measurement tool, social network: each drops its piece of code and receives the address of the pages you visit, identifiers, sometimes content. Matched with a cookie or an advertising identifier, that data follows you from service to service. Receiving data doesn’t prove it is sold, but it has left the service you chose. Refusing cookies cuts some of it, rarely all of it, and filtering on the way out catches a good share of the rest.

Tracking pixel (spy pixel)

Invisible one-pixel image, slipped into an email, that alerts the sender as soon as you open it.

When it loads the image, your mail client sends your IP, the time and an identifier tied to your address: the sender knows you opened it, when, from where and how many times. On 14 April 2026, the CNIL classed them as trackers subject to consent, except for measuring the deliverability of a transactional email. Apple Mail (“Protect Mail Activity”) and Proton Mail neutralize them. Gmail routes images through a proxy that hides your IP, not the moment you open the email.

See also: Metadata · Browser fingerprinting · MAID · Tracker

Trilogue

Closed-door negotiation between the European Parliament, the Council and the Commission, where the final text of a regulation gets written.

That’s where everything plays out, and it’s closed to the public, so opaque and hard for citizens to influence. The CSAR (Chat Control 2.0) entered it in December 2025 and, at the end of September 2026, six rounds later, still had not come out.

Trusted System Agent

Framework Apple proposed to European regulators in 2026 to reconcile Siri AI with the interoperability the DMA requires.

Competing assistants would have gone through a system agent certified by Apple rather than accessing device data directly. In June 2026, Apple claimed the Commission had rejected it, and used that as grounds not to launch Siri AI on iPhone and iPad in the EU. The Commission replied that the decision not to launch was Apple’s alone.

U

ufw (Uncomplicated Firewall)

Simplified firewall interface on Debian and Ubuntu.

In a few readable commands, you block all incoming connections by default (default deny incoming). Then you open only the service you want, ideally on a private network interface only.

See also: Tailscale · unattended-upgrades · VPS

unattended-upgrades

Debian and Ubuntu package that installs the system’s security fixes on its own.

No intervention, no change to the rest of your configuration. Known flaws close on their own, where nobody logs in every morning to patch by hand. An unpatched server is a vulnerable server.

Unbound

Open source recursive DNS server, lightweight and known for the cleanliness of its code, maintained by NLnet Labs.

It is used to run your own resolver, typically on a VPS attached to a private network (Tailscale, WireGuard) and listening only there. You resolve directly against the DNS hierarchy, without depending on a public resolver. It validates DNSSEC natively.

See also: DNS resolver · DNSSEC · Root server

Unified memory

Apple Silicon architecture where CPU, GPU and Neural Engine share a single pool of RAM.

For local AI, it’s decisive: a model can use all the available memory with no copying between components. Careful, total RAM is not usable RAM. macOS and your apps often take up 8 to 10 GB at all times, the rest goes to the model and its context.

See also: Local LLM · Parameters · SoC

User namespace

Linux kernel mechanism that gives a process its own view of identities: ordinary user outside, root inside.

It is the foundation of unprivileged containers. It is also a classic entry point for privilege escalation, since the process gains kernel capabilities there that it would never have had otherwise. Disabling them for unprivileged processes is a common hardening step on a server.

See also: Seccomp · Privilege escalation · Docker

↑ Back to top

V

Vault eDiscovery

Legal archiving module in Google Workspace and Microsoft 365, which retains and searches all of an organization’s content.

It places retention holds, even on what the user deleted, runs full-text searches and exports for lawyers. For that, the provider has to read all the content in the clear. When an organization encrypts part of its data client-side, eDiscovery no longer sees it. That is where client-side encryption costs you.

vCard (.vcf)

Standard format for exchanging contacts, digital business cards.

A .vcf file holds one or more contacts. Google Contacts exports your whole address book into a single file, which you then import into any compatible service, Proton Mail included.

vCPU (virtual CPU core)

Compute unit assigned to a virtual machine, corresponding to a share of a physical core on the host.

A VPS with 4 vCPUs has the equivalent of four logical cores. For a SIEM like Wazuh watching fifty or so machines, it’s a reasonable starting point to index and correlate without choking.

Vendor lock-in

Situation where you are stuck with a provider because leaving costs too much.

Google Workspace is the textbook case: email, documents and calendar are interlocked. Choosing open standards (IMAP, S3, CalDAV) and non-proprietary formats keeps the exit door open.

VirtioFS

Protocol for sharing files between a virtual machine and the computer hosting it.

It lets you mount a host folder inside the VM. All the security depends on what you give it: one specific folder, or the whole root of the disk, read-write. In the second case, a VM escape opens up the entire host.

VPN

Encrypted tunnel between your device and a remote server.

Virtual Private Network. Your ISP no longer sees what you do, your connection is protected on public Wi-Fi, and sites see the VPN server’s IP instead of yours. It doesn’t make you anonymous though: signed into your Google account, Google knows who you are.

See also: Kill switch · No-logs · DNS leak · WireGuard

VPS

Virtual server you rent from a host, with your own system and your own root access.

Virtual Private Server. The host carves a big server into isolated virtual machines. Like an apartment in a building: it’s yours, the neighbors can’t get in, but you share the building. Far cheaper than a dedicated server, and plenty for serious self-hosting.

W

Wazuh

Open source, self-hostable SIEM platform, heir to OSSEC, under the GPL-2.0 license.

It combines SIEM, endpoint detection, configuration management and compliance. Three components: the manager (collection and analysis), the indexer (storage) and the dashboard. It is the cornerstone of a sovereign SIEM for a small or mid-sized business.

See also: SIEM · Wazuh vocabulary · Agent · Indexer

Wazuh vocabulary

The terms you run into in Wazuh, from its modules to the rules you write.

rootcheck: module on by default that flags rootkits, hidden processes and tampered binaries, without blocking anything.
syscollector: inventory of packages, versions, ports and hardware, which vulnerability detection cross-references with CVEs.
Filebeat: Elastic agent that ships the manager’s alerts to the indexer, first suspect when the dashboard stays empty.
Heap (JVM): memory of the Java indexer, set to half the RAM, with -Xms and -Xmx identical.
Decoder: cuts a raw log into named fields; you only write one for a homegrown format, in local_decoder.xml.
prematch: fixed substring that tells the decoder “this log is for me”.
srcip / srcuser: conventional names for the source IP and the targeted account, which Wazuh knows how to correlate.
OS_Regex: its regular expression engine, with conventions different from classic regex.
Custom rule: your own detection, with IDs reserved from 100000 to 120000.
local_rules.xml: the only file to write your rules in, /var/ossec/ruleset/ is overwritten at every update.
frequency / timeframe: how many repetitions, within what window in seconds.
if_matched_sid / same_field: chaining rules and counting only events that share the same field.
wazuh-logtest: your test bench, which replays a log without touching production.

See also: Wazuh · Indexer · Correlation · Alert fatigue

WebDAV

Extension of the web protocol that lets you handle files on a server as if they were on a local disk.

Web Distributed Authoring and Versioning. On a Mac, Cmd+K in the Finder mounts a WebDAV server as a network volume, reachable from all your apps. kDrive and many NAS units offer it. Proton Drive and iCloud Drive don’t.

WireGuard

Modern, lightweight VPN protocol, about 4,000 lines of code against 100,000 for OpenVPN.

Faster, simpler to audit, less attack surface. Proton VPN, NordVPN (under the name NordLynx) and Tailscale use it.

See also: VPN · Tailscale · Mesh network

World ID

Private system for verifying human identity by iris scan, operated by Tools for Humanity (Sam Altman).

The scan is done with a dedicated device, the Orb. As of 17 April 2026, the operator claimed nearly 18 million verified users in 160 countries, and announced integrations with Tinder, Zoom and DocuSign. Kenya suspended it in 2023, Spain and Hong Kong in 2024, and Bavaria opened an investigation. The risk: a biometric database on a planetary scale, in the hands of a private actor.

X

xattr (extended attributes)

macOS command that reads and modifies extended attributes, the invisible metadata attached to every file.

The most important one is com.apple.quarantine, set on every downloaded file: Gatekeeper checks it to block or flag an executable. xattr -c wipes all attributes in one go, quarantine included, and Gatekeeper lets the file through without a word. No legitimate app needs you to run xattr -c on anything.

See also: ClickFix · TCC · Infostealer

XPR (XProtect Remediator)

Scanner built into macOS that regularly inspects the disk for threats already installed.

The second stage of XProtect, it runs in the background and neutralizes what it finds without bothering you. It replaced the old MRT (Malware Removal Tool) starting with macOS 12.3 Monterey.

XProtect

Signature antivirus built into macOS, updated automatically by Apple.

It recognizes known malware, but stays blind to polymorphic variants and fileless execution. It’s a first net, not complete protection. Since macOS 15 Sequoia, the command sudo xprotect version tells you which signature database is installed.

XTS-AES-128

Disk encryption algorithm used by FileVault on Apple Silicon.

The XTS mode is designed specifically for encrypting disks. On Apple Silicon, AES encryption is hardware-accelerated by an AES engine sitting between storage and memory: no performance impact, and it is always on.

See also: Secure Enclave · Encryption at rest

↑ Back to top

Z

Zero-day

Flaw unknown to the vendor, and therefore with no fix at the moment it is exploited.

The vendor has had zero days to fix it. It is the most feared category: no update protects you and no antivirus knows its signature. Once published and fixed, it becomes an ordinary vulnerability, dangerous only for those who haven’t updated.

Zero-knowledge

Architecture where the provider is technically unable to read your data, even if it wanted to.

Encryption happens on your device, with a key the provider never holds. A court order can’t get anything readable out of it. Proton Mail is zero-knowledge. Gmail encrypts your emails at rest but keeps the keys: it isn’t.

↑ Back to top

This glossary grows with every new article.