You run into these terms in our articles. Here’s what they mean, without the useless jargon.

5/9/14 Eyes

Intelligence alliances between countries that share their surveillance data. 5 Eyes: United States, United Kingdom, Canada, Australia, New Zealand. 9 Eyes: the 5 plus Denmark, France, Netherlands, Norway. 14 Eyes: the 9 plus Germany, Belgium, Italy, Sweden, Spain. A VPN or cloud provider based in a member country can be compelled to hand over data on government order.

ALF (Application Layer Firewall)

Application firewall built into macOS since Mac OS X 10.5 (2007). Filters incoming connections per application: you allow Skype to receive connections, you block Transmission. It does not filter outbound traffic. Turn it on in System Settings → Network → Firewall. For process-aware outbound filtering you need a third-party tool (Little Snitch, LuLu) built on NEFilterDataProvider.

ABM (Apple Business Manager) / Managed Apple ID

Apple web console for organizations, used to provision Managed Apple IDs, deploy devices through MDM (zero-touch via Automated Device Enrollment), distribute apps in volume, and federate identity with an existing IdP (Microsoft Entra ID, Google Workspace, Okta). A Managed Apple ID is an Apple account the organization administers: it can create it, suspend it, reset it, delete it. Unlike a personal Apple ID, some features are disabled (Apple Pay, Wallet, paid App Store, in-app purchases without approval). Paired with Apple Business Essentials, it is the functional equivalent of a Google Workspace Admin or a Microsoft 365 Admin Center for an Apple fleet.

APNs (Apple Push Notification service)

Apple infrastructure that carries every push notification to iPhones and Macs. When an app sends a message, the notification first travels through Apple’s APNs servers before it reaches your device. Apple can access the metadata of those notifications and hand it over to the authorities under a judicial warrant. Setting Signal and iOS to “No Name or Content” keeps the message content out of the notification payload.

ADP (Advanced Data Protection)

Reinforced iCloud encryption option, enabled in System Settings > [your name] > iCloud. Once active, only your trusted devices hold the encryption keys for nearly all of your iCloud data. Apple can no longer read it, even under a court order. Exceptions: iCloud Mail, Contacts and Calendar stay readable by Apple for interoperability reasons (CalDAV/CardDAV). Withdrawn in the United Kingdom since 2025 under government pressure.

ANSSI (French national cybersecurity agency)

France’s national cybersecurity authority, reporting to the Prime Minister. Publishes security frameworks, coordinates the response to major incidents, and oversees the transposition of European directives such as NIS2 in France. Lists the entities in scope of NIS2 and publishes the compliance guides.

ATT (App Tracking Transparency)

Apple mechanism introduced with iOS 14.5 (April 2021) that forces every application to ask for the user’s explicit permission before tracking their activity across other apps and websites. The tracking in question concerns the mobile advertising identifier (MAID), used to build cross-app profiles. Significant limit: ATT does not block an app from collecting your location when it has a legitimate functional permission for it (weather, navigation). That location can still feed RTB advertising networks through embedded SDKs.

Age broker

A public or private actor that certifies a user’s age on behalf of a third-party service. When a platform wants to check that you are of age without handling your ID papers itself, it delegates that check to a broker, which returns a plain yes/no. Several texts in progress (US HR 8250, Illinois HB 5511, UK Online Safety Act) push this role onto OS providers (Apple, Google, Microsoft) or onto accredited providers. The privacy risk is structural: centralization in the hands of two or three players, possible aggregation with other data, and no technical way to guarantee “zero-knowledge” in most current implementations.

Age verification

Mechanism requiring online services to verify their users’ age before granting access to certain content or features. Several jurisdictions have moved from a declarative check (ticking a box) to strong cryptographic verification involving an ID document, a biometric scan, a bank card, or an OS-level attestation. UK Online Safety Act, Australia Online Safety Amendment, Brazil Law 15.211/2025, the EU age verification app, US HR 8250 and Illinois HB 5511 are the main implementations in 2026. An open letter signed by 371 cybersecurity researchers (March 2026, among them Ronald Rivest and Bart Preneel) calls the rollouts under way “dangerous and socially unacceptable”.

BootROM

Boot code physically etched into the Apple Silicon chip at manufacturing. Immutable, impossible to modify by software. First link in the Secure Boot chain of trust: it verifies the authenticity of every component that boots after it.

Bouncer (CrowdSec)

CrowdSec component that enforces the engine’s decisions. The engine detects and decides to ban an IP, but never touches the firewall itself, the bouncer is what puts the blocking rule in place. The firewall bouncer (nftables or iptables) throws the offending IP out of your server. The split is deliberate: you can run several bouncers (firewall, web reverse proxy) enforcing the same decisions at their own level.

Page cache

Area of RAM where the kernel keeps a copy of recently read files, so it does not have to fetch them from disk on every access. A binary run several times is served from that cache. Corrupting the page cache therefore amounts to changing what the system believes it is executing, without ever touching the file sitting on disk. This is the mechanism exploited by the pedit COW flaw (CVE-2026-46331) in the Claude Cowork SharedRoot escape.

Daemon

A process that runs in the background on a system, with no visible interface, and that starts automatically with the user session. On macOS, daemons are managed by launchd. Proton Bridge is a daemon: it runs silently, does its job (decrypting emails, exposing local IMAP), and has no window open permanently. The menu bar icon is its only visible presence.

IMAP Bridge

Proton Mail software tool (Proton Mail Bridge) that lets you use a third-party email client, Apple Mail, Thunderbird, Outlook, with a Proton account. It installs locally on your Mac and handles encryption and decryption transparently. Available on paid plans only.

Software supply chain

The whole path a piece of software takes to reach your machine: who writes it, who compiles it, who signs it, who pushes the binary into the update. That is a very different thing from the address where the vendor is legally incorporated. Software can be published by a European company and have its code written or signed somewhere else, and it is that chain, not the company register, that decides who you are really trusting. See also supply chain attack.

Encryption at rest

Encryption of data stored on a server (as opposed to encryption in transit). Protects the data if the server is physically compromised. The key distinction: with Gmail, Google encrypts your emails at rest but holds the keys. With Proton, encryption happens before sending, and Proton does not hold the keys.

Client-side encryption

Encryption method where data is encrypted on the user’s device before being sent to the server. The provider only ever receives data that is already encrypted and does not hold the keys to decrypt it. This is the basis of the zero-knowledge model. Distinct from encryption at rest (the provider encrypts on its server but holds the keys) and from encryption in transit (data encrypted during transfer only). Proton Drive uses client-side encryption; iCloud Drive without ADP and Infomaniak kDrive use encryption at rest.

End-to-end encryption (E2EE)

Encryption method where only the sender and the recipient hold the keys to read the content. The service provider (Proton, Signal…) technically cannot access the data, even under a court order.

Client-side scanning

Surveillance technique that scans the content of a message, a photo or a file directly on the user’s device, before encryption and sending. The content is compared against a database (of child sexual abuse material, for example) and reported to the authorities when it matches. End-to-end encryption stays “technically” intact during transport, but the content was read before being encrypted. This is the mechanism at the core of the CSAR regulation (Chat Control 2.0) proposed by the EU.

CAPI (Central API, CrowdSec community network)

CrowdSec’s central API, which your engine is enrolled in by default. It works both ways: when you ban an IP you send up a minimal signal (the address, the scenario, the timestamp, never your logs), and in return you download the aggregated community blocklist. The result is that you block attackers spotted elsewhere without ever having met them. You can opt out and run purely local.

CrowdSec

Open source, self-hosted security engine that reads your logs (SSH, web, mail), detects malicious behavior through scenarios, and blocks offending IPs at the network level, on its own or through the shared community blocklist. Split in two: the engine decides, the bouncer enforces. Every deployed agent anonymously shares the attacking IP addresses it detects, feeding a pooled blocklist updated in real time: more than 10 million daily signals, over 70,000 users in 190 countries. Built by a French company founded in 2019, on a freemium model: free agent, paid premium blocklists. Native integration with Wazuh, nginx, Cloudflare and fail2ban. A sovereign alternative to SaaS anti-intrusion services. See also bouncer, CAPI.

CTI (Cyber Threat Intelligence)

Threat intelligence: collecting and sharing information about attackers (IP addresses, scenarios, tactics) to anticipate attacks. In CrowdSec, the community CTI feeds the list of known malicious IPs that you download before your very first attack.

CSAR (Child Sexual Abuse Regulation)

Proposed European regulation, also known as “Chat Control 2.0”. It would force messaging services to detect child sexual abuse material (CSAM) in private communications, including end-to-end encrypted ones, through client-side scanning. In trilogue since December 2025.

Cyber Solidarity Act

European regulation (EU 2025/38, in force on 4 February 2025) that organizes cyber solidarity between member states: shared alert mechanisms, a reserve force that can be mobilized in a crisis, a common budget. Not to be confused with CSAR (Chat Control), which targets messaging surveillance. Same family of acronyms, opposite subjects.

CVE (Common Vulnerabilities and Exposures)

Standardized identifier for a security vulnerability, format CVE-YYYY-NNNN (year + number). Maintained by MITRE and NIST through the NVD (National Vulnerability Database). Every CVE has a CVSS severity score from 0 to 10 (CRITICAL ≥ 9, HIGH 7-8.9, MEDIUM 4-6.9, LOW < 4) and a status (Awaiting Analysis, Analyzed, Modified, Reserved). Every serious security patch references its CVE. You can look up the detail of a CVE at nvd.nist.gov/vuln/detail/CVE-....

CLOUD Act

Clarifying Lawful Overseas Use of Data Act. US law from 2018 that lets American authorities compel American companies (Google, Microsoft, Amazon…) to hand over data stored abroad, without going through the usual international judicial cooperation mechanisms. Applies to Gmail, OneDrive, iCloud (US servers) regardless of your nationality or your location.

Coalition Against Stalkerware

International coalition founded in 2019 by the Electronic Frontier Foundation, Kaspersky, Malwarebytes, Norton, the Centre Hubertine Auclert (France), WESNET (Australia) and a dozen other organizations. It centralizes resources for stalkerware victims (response kits, technical advice, country-by-country contacts) and coordinates detection across vendors. Site: stopstalkerware.org, multilingual content including French. The reference to turn to when you suspect an active install on your device or on a loved one’s.

Data Privacy Framework (DPF)

EU-United States data transfer agreement adopted by the European Commission in July 2023, replacing the Privacy Shield struck down by the Schrems II ruling. It once again allows personal data transfers to certified American companies. Already challenged by organizations such as NOYB, its legal future remains uncertain.

DLP (Data Loss Prevention)

Set of mechanisms that scan the content moving through an organization (outbound emails, shared files, collaboration messages) to block leaks of sensitive information: bank card numbers, personal identifiers, internal secrets, intellectual property. Implemented server-side in Google Workspace (Vault and DLP modules), Microsoft 365 (Microsoft Purview), and some collaboration suites. Structural implication: the provider has to be able to read the content in the clear in order to scan it, which by construction rules out zero-knowledge or fully E2EE services. A fully E2EE Workspace cannot run server-side DLP on content, that is an explicit trade-off.

DMA (Digital Markets Act)

European regulation in force since March 2024 aimed at curbing the anticompetitive practices of the large platforms (Apple, Google, Meta…). For Apple users, the DMA notably opens the door to sideloading on iOS: installing applications without going through the App Store. In concrete terms, if Signal or another messaging app had to leave the European App Store, the DMA would make distribution through an alternative channel technically possible.

Docker

Containerization tool that isolates applications in independent “containers” on a single server. Each container carries everything the application needs to run (code, dependencies, configuration), without interfering with the rest of the system. Nextcloud AIO, for example, runs in a Docker container, which makes installation and updates simpler.

Deduplication

Backup technique that stores identical data blocks only once, even when they appear in several files or in several successive snapshots. Instead of copying all of your data over again on every backup, the tool only transfers what actually changed. The result is that off-site storage volume stays contained and successive backups are fast. Kopia, restic and Borg do it natively.

DNS

Domain Name System. The directory of the internet: it translates a domain name (macsouverain.com) into an IP address (83.228.215.109). By default, DNS queries often travel in the clear, so your ISP sees which sites you visit, even over HTTPS.

DNSCrypt

Protocol for encrypting and authenticating DNS queries, older than DoH and DoT, created in 2011. It cryptographically authenticates the resolver’s answer so that an attacker cannot pose as it. Widely supported by no-logs community resolvers and by clients such as dnscrypt-proxy. Distinct from DoH/DoT: DNSCrypt uses its own encrypted format, DoH rides on HTTPS, DoT on dedicated TLS. In practice, a modern client like dnscrypt-proxy speaks all three.

dnscrypt-proxy

Open source local service that runs on your machine and becomes your DNS resolver. It receives system queries on 127.0.0.1:53, encrypts them with DNSCrypt, DoH or DoT, and sends them to one or more upstream resolvers (Quad9, Mullvad, community ones). Local cache, native anti-leak (forces every system query into its tunnel), optional domain filtering, anycast multi-resolver. Installable on macOS with brew install dnscrypt-proxy. Configuration in /opt/homebrew/etc/dnscrypt-proxy.toml.

DNSSEC

Domain Name System Security Extensions. Set of cryptographic extensions that sign DNS records so the resolver can verify that an answer really comes from the domain’s legitimate authoritative server, and not from an attacker who slipped in between. Protects against cache poisoning and forged answers. DNSSEC does not encrypt queries (that is the job of DoH/DoT/DNSCrypt), it guarantees their authenticity. Enabled on the resolver side (Unbound does it natively) and on the signed domain side.

DINUM (French government digital agency)

A French agency reporting to the Prime Minister, in charge of the State’s digital strategy. In April 2026 it announced a plan to migrate 2.5 million government workstations to Linux, with seven areas targeted for cutting dependency (workstations, collaboration tools, antivirus, AI, databases, virtualization, network equipment). Sovereign video conferencing for 200,000 staff by the end of 2026, 2.5 million in 2027. Ministry plans due before autumn 2026. It is one of the most structured sovereignty counter-moves in Europe.

DNS-over-HTTPS (DoH)

A protocol that encrypts DNS queries inside a standard HTTPS tunnel, on port 443. To an outside observer (your ISP, a network admin), the traffic is indistinguishable from the rest of your web browsing. It protects the destination of your DNS queries, which never appears in the clear on the network. Natively supported on macOS since Big Sur (macOS 11).

DNS-over-TLS (DoT)

A protocol that encrypts DNS queries inside a dedicated TLS tunnel, on port 853. Technically similar to DoH in terms of protection, but easier for network administrators to spot and block. Both of them, DoH and DoT, do the same thing at bottom: make your DNS queries unreadable to anyone sitting on the network.

User namespace

A Linux kernel mechanism that gives a process its own view of user identities. In practice, you can be an ordinary user on the machine and root inside your own namespace. It is the foundation of unprivileged containers, and it is also a classic entry point for privilege escalation, since the process gains kernel capabilities it would never have had otherwise. Disabling them for unprivileged processes is a common hardening step.

Evil Twin

A Wi-Fi attack where an attacker sets up a fake access point with the same name as a legitimate network (the coffee shop’s Wi-Fi, the hotel’s…). Your device connects to it automatically, and the attacker can watch or tamper with your traffic.

Easy Switch

An import tool built into Proton Mail that migrates your emails, contacts and calendars from Gmail, Yahoo or Outlook straight into Proton. The connection runs over OAuth (no password handed to Proton), and the import happens in the background. Available from the settings of Proton Mail web.

ECH (Encrypted Client Hello)

A TLS extension that encrypts the “hello” part of setting up an HTTPS connection, the point where your browser still announces in the clear which domain it wants to reach (the SNI). Without ECH, a network observer can tell which site you are connecting to even when DNS is encrypted. The major browsers (Chrome, Firefox, Safari since Sequoia) support ECH on the client side. The brake on full deployment is on the server side: only services running behind Cloudflare or a few large CDNs have turned ECH on. For self-hosted sites, the SNI stays readable in the clear.

Ed25519

A modern cryptographic signature algorithm, based on elliptic curves, used in particular to generate SSH key pairs. Compared with older RSA keys, an Ed25519 key is much shorter, faster to verify, and at least as strong. It is the recommended default today for authenticating to a server with a key rather than a password, via the command ssh-keygen -t ed25519.

International mutual legal assistance

The procedure by which one State asks another State for help in a criminal investigation, for example to obtain data held on its territory. Far slower and far more tightly framed than a plain domestic order. This is what protects data hosted in Switzerland: a foreign government cannot demand access directly, it has to go through a Swiss judge.

Electron (apps)

A technology for building desktop apps (Discord, Slack, Teams, Notion, VS Code, Spotify…) by reusing web code. An Electron app bundles a version of the Chrome engine inside itself. The consequence: if Chrome fixes a bug, the Electron app keeps running on the old version until its next update. Electron apps that update rarely become prime targets whenever new Chrome flaws are found.

Browser exploit

Code designed to take advantage of a flaw in a web browser or in the engine of an embedded browser (like Chrome inside an Electron app). It lets an attacker run a program on your machine without your permission, typically by sending you a booby-trapped link or message. The security researchers’ convention for proving an exploit works: opening the calculator on the target machine (“pop calc”). If the calc opens without authorization, any other program can open too.

ISP

Internet Service Provider. Orange, Free, SFR, Swisscom… The company that connects you to the internet, and that sees the metadata of all your traffic.

Alert fatigue

The state where a security team gets so many notifications, often false positives or duplicates, that it ends up ignoring them. An alert drowned in noise is not seen, and a real incident slips by with the rest. Worse than no alerting at all, because it gives the illusion of being covered. You fight it by calibrating thresholds (which rule level notifies which channel) and by deduplicating upstream, in the frequency and time window of the rules, never at the moment of notification.

FISA 702

Section 702 of the American Foreign Intelligence Surveillance Act. It authorizes the NSA to collect, without a judicial warrant, the electronic communications of foreign targets located outside the United States. In practice, the communications of American citizens and residents “in contact with” those targets are swept up too. The eighteen-month reauthorization voted at the end of April 2026 was billed as a “clean extension”, with no “warrant requirement” amendment. The NSA can then search that massive database for Americans’ communications without a warrant (“backdoor searches”), a practice regularly denounced by the EFF and the Brennan Center for Justice.

Git forge

A web platform that hosts Git repositories and provides an interface to browse the code, manage versions and track issues. GitHub (Microsoft), GitLab and Gitea are examples. Gitea is a lightweight, self-hostable forge, a sovereign alternative to the centralized platforms.

DNS leak

A situation where a user’s DNS queries bypass the VPN tunnel and go straight to the ISP’s DNS resolver, revealing the domains visited. A VPN can encrypt all web traffic while still letting DNS leak outside the tunnel, depending on how it is configured. Serious VPNs force every DNS query through their own resolver. You can check on dnsleaktest.com.

Forward secrecy

A cryptographic property guaranteeing that compromising one session key does not allow past exchanges to be decrypted. Each conversation generates ephemeral temporary keys: even if an attacker records encrypted traffic today and gets hold of the private key tomorrow, past exchanges stay unreadable. Signal and Proton Mail implement forward secrecy. It is a property distinct from end-to-end encryption, and a marker of serious cryptographic maturity.

FSB

Russia’s federal security service, successor to the KGB. In the context of software sovereignty, it also acts as a certification authority: in that capacity, it has access to the source code of software submitted for approval. When a vendor goes down that road, its sources do not stay private.

FSTEC

Russia’s federal service for technical and export control, attached to the Ministry of Defense. It certifies the security of software intended for government bodies and sensitive infrastructure, and to do that it requires the source code to be submitted to accredited laboratories. In other words, the State sees the code before signing off on it.

GGUF

A quantized AI model file format, popularized by the llama.cpp project and used by Ollama and plenty of cross-platform tools. It packs the model weights and its metadata into a single file, which makes it easy to distribute and load. On a Mac it works, but it stays less optimized than Apple’s MLX format: at equivalent model and quantization, an MLX version generally runs faster on Apple Silicon. GGUF keeps the portability advantage, it also runs on PC and Linux.

Git

A decentralized version control system. Every file change is recorded, traceable and reversible. Essential for versioning code, configurations, or any text-based project. Created by Linus Torvalds (the creator of Linux), used by pretty much everyone in software development.

Harvest now, decrypt later

An attack strategy where an adversary intercepts and stores encrypted communications today that it cannot read yet, hoping to decrypt them in ten or twenty years, once a powerful enough quantum computer exists. It applies in particular to classical encryption (RSA, elliptic curves), which falls to Shor’s algorithm on a quantum machine. This is exactly what post-quantum encryption aims to neutralize.

Hugging Face

The reference community platform for hosting, sharing and downloading open source AI models, their datasets and demos. It is the “repository” where nearly every open model (Qwen, Mistral, Llama, Gemma…) gets published, often in several format and quantization variants. Tools like LM Studio or Ollama fetch models from it for you, without you ever having to browse the site. Hosting a model on Hugging Face says nothing about its license: you have to check case by case whether commercial use is allowed (Apache 2.0, MIT) or restricted.

HTTPS

HyperText Transfer Protocol Secure. The encrypted version of the HTTP protocol. It protects the content exchanged between your browser and a website. It does not protect metadata (which site you visit, when, how many times).

Identity broker

A service that authenticates a user on behalf of several third-party sites or applications, centralizing identity verification. World ID (Tools for Humanity / Sam Altman) with its 18 million users verified by iris scan across 160 countries, GOV.UK Wallet for the United Kingdom, or the EUDI digital wallets are working examples. The structural risk: a third party gains an aggregated view of every interaction a user has with all the integrated services, and that centralization creates a massive target for attacks and legal coercion. Mac Souverain’s editorial position: any identity broker that is not zero-knowledge is by construction a surveillance point.

iCloud Private Relay

A service included in iCloud+ that encrypts DNS queries and Safari traffic and routes them out through a double relay: an Apple server (which sees your IP but not the destination) then an outside partner, usually Cloudflare or Akamai (which sees the destination but not your IP). It covers Safari and some iCloud system APIs only, not Chrome, Firefox, Mail, Slack or third-party apps. It disables the DNS configured at OS level within its scope. Useful as a complement, but no substitute for a sovereign resolver for the rest of your traffic.

IMAP

Internet Message Access Protocol. The standard protocol for retrieving email. Unlike POP3 (which downloads emails and deletes them from the server), IMAP syncs in real time between the server and your mail client, the emails stay on the server, reachable from several devices. Proton Mail uses its own proprietary protocol, but Proton Bridge exposes a standard IMAP interface on 127.0.0.1 so that Apple Mail and other clients can work normally.

ISO 27001

An international standard that sets out the requirements for an information security management system. A datacenter or hosting provider certified to ISO 27001 has had its risk, access and incident management procedures audited by an independent body. The certification does not guarantee that a service is impregnable, but it does attest that a structured security approach exists and is checked regularly.

Indexer

The component of a search engine or a SIEM that files incoming logs into an optimized data structure, so they can then be searched and correlated in near real time. In Wazuh, the indexer (an OpenSearch derivative) is the most RAM-hungry brick: it is what sets the minimum memory for a SIEM server. Below 8 GB, it crawls or it stops.

Integrator (integratord)

The Wazuh daemon that reads the alert stream continuously and pushes every alert above a threshold to an external channel (self-hosted chat, webhook, custom script). It starts with the manager and is configured in ossec.conf through <integration> blocks, each with its own <level> threshold on the 0 to 16 scale. Not to be confused with the native email notifications, handled directly by the manager. It is the brick that turns a SIEM that detects into a SIEM that warns.

KIP (Kernel Integrity Protection)

An Apple Silicon hardware protection that prevents any modification of the running macOS kernel, even with root privileges. The kernel code in memory is write-protected by the processor. It makes a whole category of attacks structurally impossible, the ones that consisted of injecting malicious code into the kernel of a running Mac.

kDrive

The cloud storage service from Infomaniak, a Swiss hosting provider based in Geneva. It offers 15 GB free, then paid plans starting at 2 TB. Specifics: proprietary datacenters in Switzerland, native WebDAV support for mounting in the Finder, OnlyOffice built in for real-time document co-editing. Swiss jurisdiction (Swiss FADP). Careful: kDrive uses encryption at rest and in transit, but not client-side encryption (E2EE). Infomaniak holds the encryption keys.

KMS (Key Management Service)

A cryptographic key management service offered by the hyperscalers (AWS KMS, Google Cloud KMS, Azure Key Vault) to store, rotate and audit the keys that encrypt an organization’s data. Two main modes: provider-managed (the provider generates and keeps the key), and customer-managed encryption keys (CMEK or BYOK / HYOK, the organization keeps the key and exposes it to the service through an API). Google Workspace offers CSE (Client-Side Encryption) with an external KMS for Drive, Docs, Meet and Gmail: the key stays outside Google, which rules Google out of any CLOUD Act order aimed at the content in the clear. Functional limit: client-side encrypted content breaks a good part of the server-side features (full-text search, DLP, indexing, preview), it is an explicit trade-off.

Kill switch

A VPN feature that automatically cuts your internet connection if the VPN tunnel drops. It prevents any leak of unencrypted traffic, even for a second.

Kopia

An open source backup tool that encrypts data on the client side, before sending it to remote storage. It deduplicates to limit the volume transferred and can write to S3-compatible storage, from sovereign cloud to a local NAS. The encryption key stays with you: even the host of the backup cannot read what it stores. Losing that key makes the backups permanently unreadable, including for you.

MLS (Messaging Layer Security)

A group encryption protocol standardized by the IETF (RFC 9420). Designed for group communications (video conferencing, multi-participant messaging) with native end-to-end encryption. Unlike older protocols, MLS natively supports adding and removing participants while maintaining the confidentiality of past and future exchanges (forward secrecy + post-compromise security). Used by Proton Meet since its launch on 31 March 2026. Signal, WhatsApp and other messaging services are working on adopting it as well.

Matrix

Open, decentralized communication protocol for instant messaging, voice/video calls and file sharing, all end-to-end encrypted. Unlike Slack or WhatsApp, Matrix is federated: you can host your own server and talk to users on other servers. Synapse is the reference server, Element the most common client.

Mesh network

Network in which each device (node) connects directly to the others, peer-to-peer, without going through a central server. If one node goes down, the others keep talking. Tailscale builds an encrypted mesh network over WireGuard between all your devices.

MAID (Mobile Advertising Identifier)

Unique advertising identifier assigned to every mobile device by its operating system (IDFA on iOS, GAID on Android). Lets advertisers and data brokers follow a user from app to app to build a behavioral profile. It can be reset in the settings (Settings > Privacy & Security > Tracking on iOS), which generates a new identifier and cuts the link with the previous history, without erasing that history from third-party databases.

MFA (Multi-Factor Authentication)

Multi-factor authentication: mechanism that requires at least two proofs of identity to access an account (password + SMS code, hardware key, biometrics, etc.). Drastically reduces the risk of compromise even when a password is stolen. Made mandatory by the NIS2 directive for the entities it covers.

Man-in-the-middle (MITM)

Attack where a third party slips in between you and the server you are talking to, in order to intercept, read or alter the exchange. Common on unsecured public Wi-Fi networks.

MCP (Model Context Protocol)

Standard protocol published by Anthropic in November 2024 to plug tools, data and services into a large language model (LLM). In practice, it is what lets Claude Desktop, Cursor or Windsurf read your filesystem, query a database, or run a shell command. Built on two main interfaces, STDIO (local process) and HTTP/SSE (network). The STDIO interface ships with no isolation by default, which made it a documented attack vector in April 2026 via OX Security (200,000 vulnerable instances, Anthropic’s position “by design”).

MDM (Mobile Device Management)

Remote management mechanism for Apple devices, originally designed for corporate fleets and school deployments. An MDM configuration profile, installed on an iPhone or an iPad, gives an administrator extensive rights: force a passcode, restrict apps, read the hardware inventory, sometimes push or pull applications. The profile can be flagged removalDisallowed to stop the victim from removing it without knowing the supervision passcode. In a company setting it is legitimate. At home, it has become the main vector for iPhone stalkerware: someone close to you supervises your phone with Apple Configurator for two minutes, installs a profile under a harmless name (“iOS Update”, “Battery Optimizer”), then reads your data remotely. Visible under Settings > General > VPN & Device Management.

Metadata

Data about data. For an email: who sent it, to whom, when, from which IP, but not the content. For your browsing: which sites, at what time, how often. Often more revealing than the content itself.

MIE (Memory Integrity Enforcement)

Kernel memory protection introduced by Apple with the M5 chip (announced 2025), etched into the silicon. Built on ARM v9’s MTE hardware extension (Memory Tagging Extension): every memory allocation receives a secret tag, and the processor refuses any read or write whose tag does not match. Designed to block in hardware the entire classes of memory corruption (use-after-free, buffer overflow) behind most macOS and iOS kernel exploits. Presented by Apple as the culmination of five years of defensive work. First public bypass demonstrated on 14 May 2026 by Calif.io with help from Anthropic’s Mythos, patched in macOS Tahoe 26.5 on 11 May 2026.

MTE (Memory Tagging Extension)

Hardware extension of the ARM v9 architecture, the one Apple builds MIE on. The processor assigns a 4-bit tag to every 16-byte block of memory, and the same tag is stored in the pointers that access it. Any mismatch triggers a kernel exception. First serious implementation in a consumer chip with the M5. Not to be confused with software-only MTE (Google tried that approach on the Pixel), which does not offer the same guarantees.

NEFilterDataProvider (Network Extension)

Apple framework introduced with macOS Big Sur (2020) that replaces the old kernel extensions (kext) for network filtering. Modern outbound firewalls (Little Snitch 5+, LuLu 2+) run in NetworkExtension userspace, not in the kernel. Upsides: no more risk of a kernel panic caused by a third-party kext, mandatory Apple signature, strict sandboxing. Limit: only one NEFilterDataProvider can be active at a time on macOS, so installing LS and LuLu side by side is impossible (one overwrites the other).

NIS2 (Network and Information Security 2)

European cybersecurity directive that came into force in January 2023. Extends security obligations to roughly 15,000-18,000 French entities (against ~500 under NIS1): any organization with more than 50 employees and 10 million euros in revenue in the covered sectors (health, energy, digital, finance, transport). Article 21 requires, among other things, encryption of data in transit and at rest, MFA and secure communications. Article 20 makes executives personally liable. France had still not transposed NIS2 into national law in April 2026 (deadline: October 2024). Structurally at odds with the CSAR regulation, which wants to bypass encryption by design.

No-logs

Policy of a VPN provider claiming it keeps no record of your connections (sites visited, times, IP addresses). Trustworthy only if verified by an independent audit.

Nextcloud

Self-hostable open source collaboration platform: file storage, calendar, contacts, notes, video conferencing. Sovereign alternative to Google Workspace and Microsoft 365. The AIO (All-in-One) version simplifies deployment via Docker. Supports client-side end-to-end encryption (E2EE).

nLPD (Swiss FADP, revised Federal Act on Data Protection)

Swiss personal data protection law, revised and in force since September 2023. Close to the European GDPR in its principles (consent, transparency, right of access), but legally distinct. Swiss companies such as Proton or Infomaniak fall under the Swiss FADP, and comply with the GDPR for the data of European residents (extraterritorial application of the GDPR, article 3).

OAuth

Open Authorization. Standard protocol that lets an application access your data on another service without you handing it your password. You explicitly grant access through a window from the original service (Google, Apple…), which issues a temporary token with limited scope. This is what Proton Easy Switch uses to connect to Gmail: you authenticate with Google, which gives Proton read access to your mailbox, without Proton ever seeing your Google password.

Bearer token

Access token a service hands you after authentication, and which is enough to act in your name for as long as it stays valid. Bearer means whoever holds the token is treated as you, with no re-check of your password or your two-factor, those two only protect the moment the token is issued. A stolen token therefore stays accepted by the servers until it expires, often a few days, and a plain local logout only wipes the copy on your machine without revoking it server-side. Real revocation goes through your account (invalidating sessions) and rotating the key involved. See OAuth.

OpenPGP

Open end-to-end encryption standard for email, defined by RFC 4880 and then RFC 9580 (2024). Uses public key cryptography: every user has a private key kept locally and a public key published. Any compatible client (Proton Mail, Thunderbird, GnuPG, Mailvelope, etc.) can read and write OpenPGP email. It is the opposite of a proprietary protocol locked inside a single app. The draft-ietf-openpgp-pqc draft extends OpenPGP with post-quantum algorithms to withstand future quantum computers.

Online Safety Act (UK)

British law of 2023, in enforcement since 25 July 2025 under Ofcom’s supervision. Requires online platforms, adult sites and some social networks included, to protect minors, robust age verification among the obligations. In the first quarter of 2026, Ofcom opened more than ninety investigations and issued six fines (Kick Online Entertainment £800,000, 8579 LLC £1.35M, 4chan £520,000). A joint ICO and Ofcom statement (March 2026) makes clear that “self-declaration” alone is not considered effective. A model text since copied by Australia, Brazil and the European Commission.

OnlyOffice

Open source office suite (AGPLv3) developed by Ascensio System SIA, an alternative to Microsoft Office and Google Docs for word processing, spreadsheets and presentations. Native compatibility with Microsoft formats (.docx, .xlsx, .pptx) and real-time multi-user co-editing. Integrates into Nextcloud, Infomaniak kSuite (kDrive + Mail), ownCloud and several sovereign offerings as their document collaboration module. Self-hostable via Docker (Document Server). Editorial position: it holds up the “co-edit documents” function without Google Workspace or Microsoft 365, provided you accept the feature trade-off against the most advanced proprietary suites.

Open source

Software whose source code is public and verifiable by anyone. Lets independent researchers check that there is no backdoor or hidden flaw.

Process-aware outbound firewall

Firewall that intercepts a machine’s outbound connections and returns an allow/drop verdict per process and per destination. Key difference with a classic IP/port firewall: it knows that Photos.app is the one talking to apple.com, not just “outbound HTTPS traffic”. On macOS, two tools dominate: Little Snitch (Objective Development, paid, closed-source, Viennese) and LuLu (Patrick Wardle / Objective-See, free, GPL-3.0 OSS, American). Both rely on Apple’s NEFilterDataProvider framework. Complements ALF (inbound) and Santa (binary execution), independent layers.

Captive portal

Web page shown automatically when you connect to a public Wi-Fi network (hotel, café, airport). You usually have to accept terms or identify yourself before reaching the internet. The problem: an attacker can set up a fake captive portal imitating the legitimate network’s one to harvest your credentials or install malware.

Post-quantum (encryption)

Family of encryption algorithms designed to withstand a future quantum computer powerful enough to matter. The classic algorithms (RSA, elliptic curves) would be broken by Shor’s algorithm on a mature quantum machine. In August 2024, NIST standardized ML-KEM (FIPS 203, derived from Kyber) for key exchange and ML-DSA for signatures. Most 2026 deployments are hybrid: they combine a proven classic algorithm with a recent post-quantum one, so that security does not rest on the newcomer alone if a flaw is found in it. Apple iMessage shipped it in February 2024 (PQ3), Signal in September 2023 (PQXDH), Tuta in 2024 (in-house scheme), Proton Mail in May 2026 on standardized OpenPGP. The point is not to defend against an existing threat but to get ahead of the “harvest now, decrypt later” strategy.

Configuration profile

A .mobileconfig file that an iPhone, an iPad or a Mac can install to apply a predefined set of settings: corporate Wi-Fi, VPN, restrictions, password constraints, root certificates, MDM access. Designed for fleet administrators, the mechanism is legitimate when your employer or your school deploys it. It becomes a problem when someone close to you installs one on your phone without your knowledge, typically via Apple Configurator with a cable: the profile can be flagged removalDisallowed, given a harmless name (“iOS Update”, “Battery Optimizer”), and hidden behind a Screen Time passcode. Worth checking regularly under Settings > General > VPN & Device Management.

Signal Protocol

Open source cryptographic protocol developed by Open Whisper Systems, distinct from the Signal application. Combines asymmetric encryption (public/private keys), the double ratchet algorithm (forward secrecy on every message) and preliminary key agreement (X3DH). Used by Signal (the app), WhatsApp, Skype (as an option) and other messengers. Its distinctive property: even if an attacker recovers the session keys at a given moment, they cannot decrypt past or future messages. WhatsApp uses the Signal protocol to encrypt messages, but the app itself stays proprietary and collects metadata.

PAC (Pointer Authentication Codes)

Apple Silicon hardware security mechanism that cryptographically signs every function pointer. Before running a function, the processor checks the pointer’s signature, and if someone has altered it to redirect to malicious code, the check fails. Blocks ROP and JOP attacks, two massively used exploitation techniques.

Tracking pixel (spy pixel)

Transparent one-by-one pixel image, hosted on a remote server, embedded in the HTML of an email. When your mail client loads the image, it sends an HTTP request to the sender’s server, which records your IP, your mail client, the time you opened it and a unique identifier tied to your email address. Result: the sender knows you opened it, when, from which city and how many times. Widely used by newsletters, B2B marketing emails (Mailchimp, HubSpot, Outreach) and e-commerce services. On 14 April 2026 the CNIL adopted its recommendation on tracking pixels: they are now treated as trackers within the meaning of article 82 of the French Data Protection Act. Consent is required by default, with a single exemption: measuring the individual deliverability of a transactional email (confirmation, alert, reset). Apple Mail (“Protect Mail Activity”, “Block All Remote Content”) and Proton Mail (server-side filtering, on by default) neutralize these pixels. Gmail does not block them.

DNS resolver (recursive)

DNS server that does the lookup legwork for you. When your Mac asks for proton.me, the recursive resolver queries in turn a root server, the .me TLD server, then the domain’s authoritative server, and hands you back the final IP address. By default, your resolver is your ISP’s (pushed by DHCP from the router). It can be replaced by a public resolver (Quad9, Cloudflare, NextDNS, Mullvad), a local resolver (dnscrypt-proxy), or your own recursive resolver (Unbound on a VPS). See also: Root server, TLD, Authoritative server.

Root server

One of the thirteen logical entry points of the global DNS hierarchy (letters A to M, operated by different organizations including IANA, Verisign, the US Army, RIPE NCC, etc.). First port of call for a recursive resolver with no cached answer. Never gives a site’s address directly, but points to the TLD server to ask next (.com, .org, .fr, .eu…). In practice, the root servers are replicated by anycast across hundreds of sites worldwide.

RCE (Remote Code Execution)

Security vulnerability that lets an attacker run arbitrary code on the victim’s machine, remotely, with no physical access. It is the most serious class of attack, because it opens everything: file exfiltration, keylogger installation, full takeover, pivoting across the network. An RCE can be “zero-click” (no user interaction, like PEGASUS on iMessage) or need a triggering action (visiting a page, opening a file). As opposed to LCE (Local Code Execution), which requires prior local access.

Ransomware

Malicious software that encrypts the victim’s data (local files, network shares, sometimes reachable backups) then demands a cryptocurrency ransom for the decryption key. Modern variants practice “double extortion”: data is exfiltrated alongside the encryption, with a threat to publish if the ransom goes unpaid. The post-incident ecosystem (negotiators, cyber insurers, response firms) often has a converging interest in the victim paying, sometimes to the point of explicit collusion. Only reliable defense: client-side encrypted backups following the 3-2-1-1 rule, network segmentation, and a response procedure documented in advance with no dependency on middlemen.

3-2-1-1 rule (backups)

Recognized cybersecurity convention for structuring a resilient backup strategy: 3 copies of the data, on 2 different storage media, of which 1 copy off site (geographically separate), and 1 copy offline (“air-gapped”, physically disconnected). The fourth component (the second “1”) was added to the historic 3-2-1 version to answer modern ransomware specifically, which targets online backups and pulls them into its encryption. Combined with a zero-knowledge backup tool (Kopia, restic, Borg) and restores tested every quarter, this rule is the bare minimum of sovereignty over your data.

RTB (Real-Time Bidding)

Real-time advertising auction system triggered every time an ad is displayed in an application or on a website. Within a few milliseconds, dozens of potential buyers receive data about the user (MAID mobile identifier, IP address, approximate location, behavioral profile) and bid to show their ad. The problem: at every auction, that data flows to all the participants, whether they win the bid or not. Companies like Webloc (Penlink) mine these RTB streams at scale for warrantless geographic surveillance.

ROP / JOP (Return-Oriented Programming / Jump-Oriented Programming)

Exploitation techniques that reuse fragments of legitimate code already in memory (“gadgets”) to assemble a malicious execution sequence, without having to inject new code. Historically they bypassed protections such as DEP/NX. PAC (on Apple Silicon) makes these attacks exponentially harder.

S/MIME

Secure/Multipurpose Internet Mail Extensions. Email encryption and signing standard based on X.509 certificates (PKI), historically dominant in corporate and government environments (Microsoft 365, Google Workspace as a paid option, ministries). Each user holds a public/private key pair certified by an authority (CA), which allows both signing (sender authenticity) and encrypting an email for a known recipient. Distinct from OpenPGP: S/MIME rests on a centralized hierarchy of trust (CAs), OpenPGP on a peer-to-peer web of trust. Both solve the same problem, they do not interoperate. Most proprietary “secure mail” Workspaces (Workspace S/MIME hosted, Microsoft 365 Message Encryption) are S/MIME, never OpenPGP.

Seccomp

Linux kernel filter that restricts which system calls a process is allowed to use. Tuned properly, it turns an exploitable flaw into a dead end: the hostile code runs, but the call it needs to go any further is denied.

SecNumCloud

Qualification framework published by ANSSI that certifies cloud providers meeting the strictest security requirements for hosting sensitive or critical data belonging to the French state and to operators of vital importance. Three pillars: strong technical security, legal immunity (no extraterritorial access rights of the CLOUD Act kind), European governance (capital, head offices, staff). In practice, SecNumCloud rules out US hyperscalers 100% (AWS, Azure, GCP), even through their French or Irish entities. Qualified providers: OVHcloud, Outscale (Dassault Systèmes), Numspot, Cloud Temple. A reference point in the European debate on cloud digital sovereignty.

Sideloading

Installing an app on a mobile device without going through the official store (App Store on iOS, Play Store on Android). On Android it has always been possible, through APK files. On iOS, the European DMA (Digital Markets Act) has allowed it since March 2024 through “alternative marketplaces”. Signal, for example, could distribute its iOS app outside the App Store if it ever had to leave the European market.

Code signing

Cryptographic signature applied to a software update. It guarantees two things: origin (the binary really does come from the vendor it claims) and integrity (nobody altered it along the way). What it does not guarantee: that the content is harmless. A vendor can sign, entirely by the book, code that still does exactly what you don’t want.

Secure Enclave

Isolated crypto-processor built into every Apple Silicon chip. It has its own memory, its own microkernel and its own AES engine, completely separate from the main processor. It stores biometric keys (Touch ID), FileVault encryption keys, and Apple Pay secrets. It never hands its keys over to the operating system: it performs the cryptographic operations on request, without exposing them.

SDK (Software Development Kit)

Set of tools a developer drops into an app to add a feature without coding it from scratch: analytics, advertising, mapping, monetization. The privacy problem: advertising SDKs embedded in legitimate apps (weather, fitness, dating) can silently collect your location and resell it on the RTB market, regardless of the host app’s own policies. You grant the location permission to the app, not to the SDK living inside it.

Authoritative server (DNS)

DNS server that holds the official truth for a given domain. For proton.me, that means the DNS servers run by Proton (or its delegate). When a recursive resolver reaches the end of the chain, the authoritative server is the one that returns the real IP address. By design it only sees the queries that concern it, never the aggregate of what one user asks for, which makes recursive resolution inherently more privacy-respecting than a centralized resolver.

Schrems II

Court of Justice of the European Union ruling of 16 July 2020 that struck down the Privacy Shield, the EU-US data transfer agreement. The Court held that US surveillance (FISA 702, Executive Order 12333) was incompatible with European fundamental rights. Consequence: storing European residents’ personal data with US companies without additional measures creates a GDPR compliance problem. Partially replaced by the Data Privacy Framework (2023), already under challenge.

Browser fingerprinting

Tracking technique that builds a unique fingerprint out of passive signals your browser gives off: canvas rendering, GPU, installed fonts, screen resolution, timezone, active plugins. That combination is distinctive enough to identify you across sites with no cookie, no explicit identifier, and in private browsing. Used by adtech networks (Meta Pixel, Google Analytics, data brokers) for cross-site tracking. Neither sovereign DNS nor a VPN changes anything about it: it is an application layer inside the browser. The answer is client-side: Firefox with arkenfox, Brave (native randomization), or extensions such as CanvasBlocker.

SNI (Server Name Indication)

TLS protocol extension that lets your browser announce which domain it wants to reach before the HTTPS connection is established. Essential for servers hosting several domains on the same IP address. Privacy problem: that announcement is still sent in the clear on most current TLS connections, which lets a network observer know which site you are connecting to even without seeing the DNS. Solution currently being rolled out: ECH (Encrypted Client Hello).

SOC 2 Type II

Recognized security audit, defined by the AICPA (American Institute of Certified Public Accountants), that assesses an organization’s controls against five criteria: security, availability, processing integrity, confidentiality, privacy. Type II = the audit covers how effectively those controls operate over an observation period (usually 6 to 12 months), not just whether they exist at a single point in time. A provider audited SOC 2 Type II has shown that its security procedures actually run in real conditions, not merely that they are documented. Proton AG has been SOC 2 Type II audited since 2023.

SoC (System on a Chip)

Architecture where CPU, GPU, memory, Neural Engine, Secure Enclave and security controllers are integrated on a single silicon die. Apple Silicon (M1, M2, M3, M4) is a SoC. Security upside: communication between components no longer travels across exposed physical buses, and memory encryption is handled directly in the integrated controller.

SMTP

Simple Mail Transfer Protocol. Standard protocol for sending email. When you click “Send” in Apple Mail, SMTP is what carries the message to the outgoing mail server. Proton Bridge exposes a local SMTP server on port 1025 of 127.0.0.1, Apple Mail sends the emails there, Bridge encrypts them and passes them on to Proton’s servers.

S3 (object storage)

Cloud storage standard invented by Amazon (AWS S3) that became a universal protocol. Data is organized as “objects” inside “buckets”, reachable through an HTTP API. Many providers offer S3-compatible storage (Infomaniak Swiss Backup, Backblaze B2, Scaleway), which avoids vendor lock-in: you can change provider without changing your backup tool.

SDP (Stolen Device Protection)

iOS security feature that switches on automatically when your iPhone is away from your usual locations (home, office). It requires biometric authentication (Face ID or Touch ID) for sensitive actions such as changing your Apple ID password or turning SDP itself off. The PIN code alone is no longer enough. Since iOS 26.4 it is on by default on new installs.

SIP (System Integrity Protection)

Protection mechanism built into macOS that stops programs, including those with root privileges, from modifying certain critical system files and folders. SIP protects /System, /usr (except /usr/local), and some extended attributes of the file system. To disable it temporarily (necessary for some advanced operations), you have to reboot into Recovery mode and run csrutil disable. Apple turns it back on automatically after every major macOS update.

SSL stripping

Attack that forces your connection down to HTTP (unencrypted) instead of HTTPS (encrypted), by intercepting the initial request. The site thinks you are secure, but the attacker reads everything in the clear.

TCC (Transparency, Consent, and Control)

macOS permission system that asks for your explicit authorization before an app reaches sensitive data: location, photos, contacts, microphone, camera, browsing history. When an app wants your photos, TCC shows a dialog box. Without your “allow”, the app gets nothing. Careful: TCC only covers part of the access that is actually granted. A second mechanism, com.apple.macl, grants permanent access through files’ extended attributes when you use the Open/Save picker, drag and drop, or a double-click. That access is invisible in the Privacy & Security interface. The “Sploitlight” flaw (March 2026) showed that third-party Spotlight plugins could bypass TCC and reach sensitive data without triggering any permission prompt.

Trusted System Agent

Framework Apple proposed to European regulators in 2026 to reconcile Siri AI with the DMA’s interoperability requirements: competing assistants would go through a system agent certified by Apple rather than reaching device data directly. The Commission has rejected it at this stage, and Apple has made it its argument for not shipping Siri AI on iPhone and iPad in the EU. Whether Siri AI reaches Europe or not hangs on the fate of this mechanism.

Trilogue

Closed-door European legislative negotiation phase between the European Parliament, the Council of the EU and the European Commission. That is where the final text of a regulation actually gets written, out of the respective positions of the three institutions. Trilogues are not public, which makes them opaque and hard for citizens to influence. The CSAR (Chat Control 2.0) has been in trilogue since December 2025.

T2 (Apple security chip)

Security chip found on Intel Macs from 2018 to 2020. It handled the Secure Enclave, Touch ID, FileVault encryption and Secure Boot on those models. Replaced and folded directly into the Apple Silicon SoC from 2020 (M1), it no longer exists as a separate component.

Tailscale

Service that creates an encrypted private network, a mesh, between all your devices, on top of the WireGuard protocol. Your machines see each other through private addresses, as if they were on the same local network, when in fact they are scattered between a datacenter, your office and your home. The rest of the internet sees nothing. In practice it lets you pull a service like SSH off the public IP and expose it only on that private mesh, making it invisible to scans from the internet.

TLD (Top-Level Domain)

Highest level in the hierarchy of a domain name, after the final dot: .com, .org, .fr, .eu, .me. Each TLD is run by an organization (Verisign for .com, AFNIC for .fr, EURid for .eu…) that maintains the DNS servers authoritative for the delegations inside the TLD. When a recursive resolver asks a root server about proton.me, the answer is “ask the .me servers”, which will in turn point to the authoritative servers for proton.me.

ufw (Uncomplicated Firewall)

Simplified firewall management interface on Linux distributions in the Debian and Ubuntu family. In a handful of readable commands, it lets you block all incoming connections by default, then open only the ports that are strictly necessary. The right hardening posture is to close everything (default deny incoming) then allow only the service you want, ideally on a private network interface only.

Unbound

Open source recursive DNS server known for the cleanliness of its code, its light footprint and its seriousness on security. Maintained by NLnet Labs (Netherlands). Used in practice to run your own personal recursive resolver, typically on a VPS, attached to a private mesh (Tailscale, WireGuard) and restricted to listening on the private interface only. It resolves directly against the DNS hierarchy (root → TLD → authoritative), without depending on a third-party public resolver. Native DNSSEC validation. Clear configuration in /etc/unbound/unbound.conf.

unattended-upgrades

Package on the Debian and Ubuntu Linux distributions that automatically installs the security fixes published for the system, with no manual intervention and without touching the rest of the configuration. Once it is enabled, a server’s known flaws close on their own, where otherwise nobody logs in every morning to patch by hand. An unpatched server is a vulnerable server.

Vault eDiscovery

Archiving and legal discovery (eDiscovery) module built into Google Workspace (Google Vault) and Microsoft 365 (Microsoft Purview eDiscovery), designed to retain, search and export emails, Drive files and Chat messages in the context of litigation, audits or internal investigations. It places holds (forced retention of items even after the user deletes them), allows full-text searches across an entire organization, and exports the results in a standard format for lawyers. Structural implication: the provider has to access all indexed content in the clear, which by design rules out running zero-knowledge or client-side encryption alongside it on the scopes concerned. When an organization turns CSE on for some content, eDiscovery stops seeing it, a trade-off accepted knowingly.

vCPU (virtual CPU core)

Compute unit assigned to a virtual machine or a VPS, corresponding to a share of a physical core on the host server. When a host advertises a VPS with 4 vCPUs, your machine has the equivalent of four logical cores to run its tasks. For a SIEM such as Wazuh watching fifty or so machines, 4 vCPUs are a reasonable starting point to absorb the indexing and the correlations without choking.

vCard (.vcf)

Standard format for exchanging contacts (digital business cards). A .vcf file holds one or more contacts with name, email addresses, phone numbers, and so on. Google Contacts can export all your contacts into a single .vcf file, which you can then import into any compatible service, Proton Mail included.

Vendor lock-in

Situation where you are locked inside one provider’s ecosystem, with a high migration cost if you want to leave. Google Workspace is the textbook case: emails, documents, calendar, everything is interlocked. Using open standards (IMAP, S3, CalDAV) and non-proprietary formats limits that risk.

VirtioFS

File sharing protocol between a virtual machine and the machine hosting it. It lets you mount a host folder inside the VM. Everything depends on what you give it to share, one specific folder or the root of the disk: in the SharedRoot case, Claude Cowork mounted the entire host read-write.

VPS

Virtual Private Server. “Virtual” because it is not a dedicated physical server: the host carves one big server into several virtual machines isolated from each other, and rents you one. Like a flat in a building: the flat is yours, the neighbours cannot get in, but you share the same building. You have your own OS, your own resources (CPU, RAM), your own root access. It is your server, hosted in a professional datacenter with a reliable connection and guaranteed power. Far cheaper than a dedicated server, and plenty for serious self-hosting.

VPN

Virtual Private Network. Encrypted tunnel between your device and a remote server. It hides your traffic from your ISP, protects your connection on public networks, and replaces your visible IP address with the VPN server’s.

WebDAV

Web Distributed Authoring and Versioning. Extension of the HTTP protocol that lets remote clients read, write, move and delete files on a web server, exactly as on a local disk. On a Mac you can mount a WebDAV server in the Finder with Cmd+K: it shows up as a network volume, reachable from any app. Nextcloud, Infomaniak kDrive and many NAS units support WebDAV. Proton Drive and iCloud Drive do not offer it natively.

World ID

Private human identity verification system, operated by Tools for Humanity (Sam Altman). It relies on iris scanning through a dedicated device, the Orb. 18 million verified users as of 17 April 2026 across 160 countries. Announced partnerships with Tinder, Zoom, DocuSign, Okta, Shopify and VanEck. Official pitch: “the first decentralized identity layer for humanity” against the bots and deepfakes generated by AI. Banned or restricted in several jurisdictions (Germany, Spain, Hong Kong, Kenya, Brazil before 2024). Mac Souverain’s position: a textbook illustration of pattern M3 (centralization around two or three identity brokers), with a structural risk of building a private biometric database on a planetary scale.

WireGuard

Modern, lightweight VPN protocol (~4,000 lines of code against ~100,000 for OpenVPN). Faster, simpler to audit, less attack surface. Used by Proton VPN, NordVPN (under the name “NordLynx”) and most serious VPNs.

Zero-knowledge

Service architecture where the provider is technically unable to access user data, even if it wanted to, even under a court order. Encryption happens client-side (on your device), with a key the provider never holds. Proton Mail is zero-knowledge: your emails are encrypted before they ever reach its servers. Gmail, by contrast, encrypts your emails at rest but holds the keys, so it is not zero-knowledge.

xattr (extended attributes)

macOS command line tool that reads and modifies the extended attributes of files: invisible metadata the system attaches to every file. The one that matters most for security is com.apple.quarantine, which macOS sets automatically on any file downloaded from the internet. That is the attribute Gatekeeper checks to decide whether an executable should be blocked or flagged. The xattr -c command strips all attributes from a file in one go, including that quarantine marker. Result: Gatekeeper treats the file as if it had always been local, no warning, no block. No legitimate app needs to ask you to run xattr -c on anything.

NSL (National Security Law, Hong Kong)

National security law imposed on Hong Kong by Beijing on 30 June 2020. Enforcement rules amended on 23 March 2026: police can now demand a suspect’s passwords and encryption keys, and refusing is a criminal offense. The first historic democracy to compel the handover of cryptographic keys head-on. Mac Souverain’s position: a comparison point for measuring what CSAR (EU) and the Meta NM verdict (US) achieve by other routes, contract or case law, without imposing direct compulsion.

eIDAS 2.0

European regulation on electronic identification and trust services, version 2, phasing into application since 2024. It creates a legal framework for European Digital Identity Wallets (EUDI Wallets), the digital identity wallets every member state must provide to its citizens by the end of 2026. Online platforms classed as very large (in the DSA sense) must accept these wallets for login. A public procurement market wide open to integrators like Thales, IDEMIA, Entrust. Mac Souverain’s position: a textbook illustration of the pattern where regulation creates the need and the market sells the solution.

XTS-AES-128

Encryption algorithm used by FileVault on Apple Silicon. XTS (XEX-based tweaked-codebook mode with ciphertext stealing) is designed specifically for disk encryption. On Apple Silicon, AES operations are hardware accelerated in the memory controller, zero performance impact, encryption always on.

C2 (Command and Control)

Attacker controlled server that remotely drives infected machines and receives the exfiltrated data. Blocking outbound network traffic to known C2 domains (via Little Snitch or LuLu, using IOCs published by security researchers) kills the operation even if the malware already ran locally. C2 domains are often compromised WordPress sites or freshly registered domains, dropped within days to stay ahead of the blocklists.

EDR (Endpoint Detection and Response)

New generation behavioral antivirus that watches what processes do in real time, as opposed to classic signature antivirus that simply matches hashes of known files. EDR tools detect attack chains (file creation, privilege escalation, suspicious outbound connection) rather than individual files, which makes them far more effective against polymorphic or fileless malware. On macOS, the free Objective-See tools (KnockKnock, BlockBlock, LuLu, ReiKey) cover a good share of the EDR use cases for an individual user.

Fileless (malware)

Malware that runs in memory without ever writing its full code to disk, which bypasses most signature antivirus and drastically limits the forensic traces left after cleanup. The payload is typically loaded by a lightweight script (PowerShell on Windows, AppleScript or shell on macOS) that downloads and executes the code in RAM. Advanced variant: abuse of Apple signed native binaries (osascript, curl, bash) to slip past XProtect and EDR tools.

Infostealer

Family of malware specialized in stealing credentials, session cookies, password manager contents (macOS Keychain, browsers), crypto wallets and sensitive files. The data is exfiltrated to a C2 server, then resold on underground marketplaces. Recent infostealers (MacSync, AMOS, Banshee) target macOS through social engineering rather than technical flaws: the user runs the payload himself after following booby-trapped instructions.

AMOS (Atomic macOS Stealer)

macOS infostealer sold by subscription (Malware-as-a-Service), one of the most widely distributed on Mac since 2023. It sweeps up the Keychain, session cookies, crypto wallets and whole files, then exfiltrates to a C2 server. It spreads through social engineering, fake “cracked” apps, fake installers, commands pasted into Terminal (see ClickFix), not through a technical flaw. Continuously updated and polymorphic, it keeps a step ahead of signature antivirus. See Infostealer.

ClickFix

Fast growing social engineering technique: a web page or a message displays a fake “system error” or “human verification” and asks you to paste a line into Terminal to “fix” it. The line is a curl ... | bash that downloads and runs the payload in one shot, so you install the malware yourself. No flaw is exploited, the vector is you. The counter: never paste into an interpreter a command that a web page is pushing you to run.

IOC (Indicator of Compromise)

Verifiable technical element that proves or suggests a machine or a network has been compromised. The most useful public IOCs are C2 domains, SHA-256 hashes of malicious binaries, download URLs, and the IPs of exfiltration servers. Researchers publish a campaign’s IOCs so potential victims can block or detect quickly (Little Snitch filters, firewall rules). IOCs age fast, attackers rotate their infrastructure every few days.

Malvertising

Contraction of malicious advertising. Malware distribution through sponsored ads on legitimate ad networks (Google Ads, Meta Ads, Microsoft Ads). The attacker bids on a popular keyword (often the name of a piece of software people are searching for) and points the ad at a booby-trapped install page, sometimes hosted on the software’s real domain through secondary features (shared chats, GitHub Pages, forum posts). A particularly effective vector, because the victim is actively trying to install something and pays less attention to the warning signs.

Polymorphic (malware)

Malicious code that rewrites itself with every distribution, producing a binary with a unique SHA-256 hash for each victim. The technique neutralizes aggregated hash based indicators of compromise (SHA-256 blocklists become useless) and complicates signature detection. Behavioral antivirus (EDR), which looks at what the code does rather than what it is, stays effective.

XProtect

macOS native signature antivirus, built silently into the system and updated automatically by Apple through YARA rules. It detects known malware from public signatures, but stays blind to polymorphic variants and fileless execution. Treat it as a first net, not as complete protection. To go further, add the Objective-See tools or a commercial EDR. Since macOS 15 Sequoia, XProtect has moved to /var/protected/xprotect/ and ships a native sudo xprotect version command to query the installed signature database.

XPR (XProtect Remediator)

Active scanner built into macOS, the second stage of the XProtect defense. It runs in the background and regularly inspects the disk for threats that are already installed. When it finds one, it neutralizes it without prompting the user. Successor to MRT (Malware Removal Tool), deprecated in April 2022. Introduced with macOS 12.3 Monterey.

CloudKit

Apple’s cloud sync service, normally used for iCloud Photos, the Keychain, iMessage and third-party apps. Since macOS 15.2 Sequoia, Apple also uses it as the exclusive distribution channel for XProtect signatures: updates travel over CloudKit, with no notification, usually within 24 to 72 hours.

npm (Node Package Manager)

Central software registry of the JavaScript ecosystem. Developers publish and download packages with npm install. Historically a fragile link in the software supply chain: a single compromised package can hit millions of machines within hours (see supply chain attack, Mini Shai-Hulud).

Stalkerware

Spyware sold to the general public and installed covertly on the phone of someone close, usually a spouse, an ex or an adult child, to read their messages, listen to their calls, track their location and switch on their microphone remotely. It differs from mercenary spyware like Pegasus or Predator by its commercial target (an individual buyer paying thirty or a hundred dollars a month, not a state) and by how it is installed (physical access to the phone, two minutes while the victim is doing something else). Long running brands that leak regularly: mSpy, Spyzie, Cocospy, TheTruthSpy, FlexiSpy. The companies are usually registered as Cypriot or offshore holdings, rebranded every eighteen months when a leak exposes them. On iPhone, the dominant vector is a disguised MDM configuration profile installed through Apple Configurator. On Android, an app hidden behind a system sounding name with accessibility enabled. The total market runs past a million paying users worldwide. See also: Coalition Against Stalkerware (stopstalkerware.org).

iPhone supervision

Mode in which an iPhone is administered from a management workstation through Apple Configurator (a Mac app) or an MDM solution. Supervision gives the administrator extended rights that a standard MDM enrollment does not: the user is barred from removing the profile (removalDisallowed), hardware restrictions, app control, detailed inventory access. Supervised mode is legitimate on corporate fleets and school deployments, but it is perverted in the domestic stalkerware context: someone close supervises your iPhone in two minutes with a Lightning or USB-C cable and a Mac, then installs a locked profile. To check whether your device is supervised: Settings, at the top, the line “This iPhone is supervised” if it is. Apple has quietly cut back supervision capabilities on the Apple Configurator side since iOS 17 to limit the misuse.

Supply chain attack

Attack that does not target its final victim directly but goes through a trusted intermediary in the software chain, typically a widely used open source package. The attacker compromises the weak link (a misconfigured CI/CD pipeline, an isolated maintainer, an abandoned dependency), and the payload propagates automatically to every downstream user, signed and verified as legitimate. The dominant vector in critical software incidents since 2024.

Pull request (PR)

Standard mechanism for contributing to an open source project hosted on GitHub. An outside contributor proposes a code change through a PR, and the project maintainer reviews it, comments, accepts or rejects. The social pillar of modern open source development. When it is misconfigured (a permissive pull_request_target workflow), a malicious PR can run code with the target repository’s privileges, an increasingly common supply chain attack vector.

TanStack

Open source ecosystem of JavaScript utility libraries (React Query, React Router, TanStack Form, TanStack Table). Widely used by modern web developers, including OpenAI, Netflix and Shopify. Target of a supply chain compromise on 11 May 2026 (170+ poisoned packages in six minutes through a hijacked GitHub Actions pipeline).

Mini Shai-Hulud

npm malware, a variant of the Shai-Hulud worm that appeared in 2024. It specifically targets developer machines: passwords, cloud access keys (AWS, GCP, Vault), GitHub and npm tokens, private SSH keys, session files. On macOS it persists through a LaunchAgent. The first documented case of a malicious npm package carrying a valid SLSA attestation, a sign that modern trusted signing chains guarantee nothing when the CI/CD pipeline itself is compromised.

Private Cloud Compute (PCC)

Apple’s cloud infrastructure dedicated to the Apple Intelligence requests that are too heavy for the local model. It runs on Apple custom silicon with five technical guarantees: stateless computation (data is never kept after the request), protections enforced by engineering rather than by contract, no privileged runtime access, non-targetability (a request cannot be routed to a specific node), and verifiable transparency (every build published in a cryptographic log, images open to inspection). To date the most auditable cloud AI stack on the consumer market, but it is not end-to-end encryption: the text is decrypted on Apple’s side for the duration of the computation.

Homomorphic encryption

Cryptographic technique that lets a server compute on encrypted data without ever decrypting it. The holy grail of cloud confidentiality. Private Cloud Compute does NOT use this technology (far too expensive computationally at scale): it relies on a hardened, signed and attested enclave where the text really is decrypted for the duration of the processing. The distinction is crucial for anyone assessing the real level of guarantee a cloud AI service offers.

Neural Engine

Coprocessor dedicated to accelerating machine learning computation, built into Apple Silicon. It is what runs, alongside the GPU and the CPU, the on-device Apple Intelligence model (around 3 billion parameters) without any data leaving the chip. A pillar of Apple’s privacy-first promise within the local perimeter.

Quantization-Aware Training (QAT)

Training method that prepares an AI model to work with heavily compressed weights (2 bits per weight in the Apple Intelligence case) while limiting the quality loss. It makes it possible to fit a model of several billion parameters into roughly 1 GB of memory, the condition for running it locally on a Mac or an iPhone rather than in the cloud.

SIEM (Security Information and Event Management)

System that collects the logs from every piece of IT equipment in an organization (servers, firewalls, workstations, mailboxes), centralizes them in a usable format, detects abnormal behavior by correlation, and raises alerts in real time. An indispensable technical building block for meeting GDPR obligations (notify the CNIL within 72 h, article 33) and NIS2 (early warning within 24 h, article 21). The SaaS market is dominated by Splunk, Microsoft Sentinel and CrowdStrike, all subject to the CLOUD Act. Sovereign open source alternatives: Wazuh (central platform), CrowdSec (network defense), Rspamd (mail filtering), Santa (execution control on Mac).

DORA (Digital Operational Resilience Act)

European regulation on the digital operational resilience of the financial sector (EU 2022/2554), applicable since 17 January 2025. It imposes strict obligations on banks, insurers, asset managers and trading platforms, as well as on their critical tech providers (cloud, data analytics, software), covering IT risk management, resilience testing, incident notification and supply chain monitoring. Its logic overlaps with NIS2 on the cyber perimeter while extending it to tech subcontractors.

CRA (Cyber Resilience Act)

European regulation (EU 2024/2847) in force since 10 December 2024, fully applicable on 11 December 2027. It imposes cybersecurity requirements on any product with a digital component sold on the European market: connected devices, software, firmware, industrial equipment. Liability extends to manufacturers and distributors, with an obligation to maintain the product throughout its lifetime and to report exploited vulnerabilities within 24 h. It stretches the EU’s cyber reach well beyond the NIS2 entities.

Wazuh

Mature open source SIEM platform, a fork of the historic OSSEC, self-hostable under GPL-2.0. It combines SIEM, EDR, configuration management and compliance (PCI-DSS, HIPAA, NIST). Three component architecture: manager (collection and analysis), indexer (Elasticsearch fork storage), dashboard (Kibana fork visualization). Used by Fortune 100 companies. The cornerstone of a sovereign SIEM for a small or mid-sized business.

Rspamd

High performance open source anti-spam and anti-phishing filter, written in C, powering the reference self-hosted mail solutions (Mailcow, Zimbra, Mailu). A scoring engine that combines Bayesian analysis, RBL lists, DKIM/SPF/DMARC checks, neural networks and customizable rules. Indispensable in front of a small business mail server to intercept the number one intrusion vector, phishing. Its logs feed straight into Wazuh.

Santa

Execution control system for macOS, running in allowlist or blocklist mode: it decides which applications may start on a machine according to signature or hash rules. Originally developed at Google in 2014, the project was transferred in 2024 to North Pole Security, a dedicated company founded by the former Google maintainers. Runs in production at Figma and at many companies keen to harden their Mac fleet. It blocks a ransomware downloaded by mistake, because it is not on the allowlist of approved vendors.

Allowlisting

Security approach that only lets explicitly approved programs run (by signature or hash), everything else is blocked by default, the opposite of an antivirus running after known threats. On macOS, Santa in lockdown mode applies this principle and kills an unapproved binary at the moment it executes, including a stealer dropped after the fact. Its limit: a payload that stays pure script goes through an interpreter that is already approved (bash, osascript), hence copy-paste hygiene as a complement. See Santa.

SCA (Security Configuration Assessment)

Configuration audit module built into Wazuh, on by default. It compares a machine’s configuration against recognized hardening baselines (the CIS benchmarks) and lists, check by check, what is compliant and what is not: one service too many, a permission that is too broad, a forgotten SSH setting. Gives you a hardening score and the gaps to fix, without installing anything beyond the agent.

FIM (File Integrity Monitoring)

File integrity monitoring. The SIEM keeps the cryptographic fingerprint of sensitive files (system binaries, configuration files) and raises an alert as soon as one of them is modified, created or deleted. A system file that changes for no reason is often the first sign of an intrusion. On by default in Wazuh under the name syscheck.

rootcheck

Wazuh module that hunts for rootkits and system anomalies, running in the background by default. It looks for the classic signs of a stealthy compromise: hidden files, processes that do not show up where they should, nonsensical permissions, tampered system binaries. It blocks nothing, it reports. Useful, but only worth reading once your day to day usage has settled down, otherwise it is just one more source of noise.

Active response

Wazuh module that runs a script in reaction to an alert: ban an address at the firewall, kill a process, cut a session. This is the SIEM going from spectator to actor. Powerful and dangerous: badly calibrated, it can lock you out of your own infrastructure on a single false positive. You only wire it up once you know its rules by heart, with an allowlist of addresses that are never blocked, your admin IP first in line.

syscollector

Wazuh’s inventory module. The agent draws up the list of what is installed on each machine (packages, versions, open ports, hardware) and sends it back to the manager. On its own, it only inventories. Its real value comes when vulnerability detection cross references that inventory with a CVE feed to tell you which installed software is running a vulnerable version.

EPS (Events Per Second)

The number of events, the log lines, that a SIEM ingests per second. It is the capacity metric of a monitoring server: a properly sized Wazuh node (on the order of 16 GB of RAM and 8 vCPUs) handles around 5,000 EPS. When the ingestion queue saturates, the SIEM does not slow down, it drops the events it has no time to process, and a dropped alert is an alert you will never see.

Heap (JVM)

The block of RAM a Java application reserves at startup to work in (the “heap”). Wazuh’s indexer runs on the Java virtual machine, and its heap is performance setting number one. Official rule: set it to half the machine’s RAM, with the lower and upper bounds identical (-Xms and -Xmx), so the JVM does not spend its time resizing it. Too small and the indexer chokes; too large and it suffocates the rest of the server.

Filebeat

Small log shipper from the Elastic suite, used by Wazuh to push the manager’s alerts to the indexer. Discreet and needing no day to day tuning, it is often the first thing you look at when data stops reaching the dashboard.

Agent (SIEM)

Small probe installed on every machine in the fleet, server, Mac, Windows workstation, that collects its logs, its security events and its file integrity, then sends it all back to the central manager. Without agents, the SIEM only sees itself. With them, it sees the whole fleet. With Wazuh, the agent is lightweight, free and unlimited in number.

Enrollment (SIEM agent)

The step where a machine registers with the manager to be monitored. The agent exchanges a key with the server, on port 1515 with Wazuh, then sends its data on port 1514. Once enrolled, the agent shows up in the console with a status: Active, Pending, Disconnected or Never connected.

Custom rule (Wazuh)

A detection rule you write yourself, as opposed to the thousands of generic rules shipped with Wazuh. It asks a precise question of a real log, for example “tell me when someone fails to authenticate against my password vault”. A good custom rule does not try to cover everything: it targets one event, builds on what already exists through <if_sid>, and stays quiet about the rest. Its IDs are reserved in the 100000 to 120000 range so they do not collide with system rules.

local_rules.xml

The file where your Wazuh custom rules live, at /var/ossec/etc/rules/local_rules.xml on the manager. It is the only place to write your rules: the /var/ossec/ruleset/ directory is rewritten in full at every Wazuh update, and any customization left there disappears without a word. Its equivalent for decoders is local_decoder.xml.

Decoder (Wazuh)

The building block that cuts a raw log into named fields, a source address, a user, an action, before the rules examine it. Most known formats (SSH, system services) are already decoded out of the box. You only write a custom decoder when Wazuh does not understand the format of a homegrown or exotic log. It is made of two blocks, a parent that recognizes the application and a child that extracts the fields, and it lives in local_decoder.xml.

prematch

A Wazuh decoder tag that acts as a switch: a stable substring the engine looks for in the line to decide “this log is for me, I will decode it”. For a log that is not in syslog format, with no program field to latch onto, a <prematch> on a fixed pattern in the line is often the sturdiest handhold before extracting the fields.

srcip / srcuser

Conventional Wazuh field names for the source IP address (srcip) and the targeted account (srcuser) of an event. Naming them this way is not cosmetic: srcip is the field Wazuh knows how to geolocate and correlate from one alert to the next. A decoder that files the address and the account under those names lets the rule that queries them count attempts per address or spot the one who keeps hammering.

OS_Regex

Wazuh’s default regular expression engine, inherited from OSSEC. Careful, this is not classic regex: its conventions differ, to the point that a dot . there means “any character” and not the literal dot. Hence the importance of testing every decoder and every pattern in wazuh-logtest before trusting it. For complex patterns, Wazuh also offers PCRE2, closer to the regex you are used to.

wazuh-logtest

Command line tool of the Wazuh manager, at /var/ossec/bin/wazuh-logtest, that replays the three phases of processing on a single log line: pre-decoding, decoding, matching. It is your test bench: you paste a log in, you check which fields come out and which rule catches it, you write your rule, you paste the log again and you watch the result change, without ever touching production. Formerly ossec-logtest, renamed in the move from OSSEC to Wazuh in version 4.0. The -U rule_id:level:decoder option validates an expected result in a single command.

Full Disk Access (FDA)

macOS permission that gives an application access to all protected files, beyond what TCC grants case by case. A security agent packaged as a binary rather than as a .app, like the Wazuh agent, stays blind to sensitive areas until it has been granted Full Disk Access, usually through an MDM profile on a managed fleet. See TCC.

Local LLM

A large language model (LLM) that runs directly on your machine, rather than on a provider’s remote servers. Everything happens at home: no request goes out over the network, no data leaves your computer, and the tool keeps working even with no connection or if the provider of a remote model cuts off your access. On a Mac, it is Apple Silicon’s unified memory that makes this possible on a consumer machine. Common tools to run one: Ollama, LM Studio, MLX.

Unified memory

Memory architecture specific to Apple Silicon where the processor (CPU), the graphics card (GPU) and the Neural Engine share one single pool of RAM, instead of each having its own. A decisive advantage for local AI: a model can use all the available memory with no costly copying between components. Careful, total RAM is not usable RAM: macOS and your applications consume part of it at all times (often 8 to 10 GB), and the rest is what has to hold the model and its context.

Quantization

Technique that compresses an AI model by reducing the precision of its weights (for example from 16 bits to 4 bits per weight). The result: the model takes up far less memory and runs faster, at the cost of a slight quality loss, usually imperceptible in everyday use. This is what makes it possible to fit a 24 or 32 billion parameter model into the memory of a consumer Mac. The “Q4” notation means 4 bit quantization.

Parameters (model weights)

The numerical values learned during an AI model’s training, which encode everything it “knows”. Their number, expressed in billions (3B, 7B, 24B, 32B, 70B…), gives a rough idea of the model’s capacity: the more there are, the more powerful the model, but the more memory it eats. The parameter count combined with the quantization level determines the size of the file to load into RAM, and therefore whether or not it fits on your machine.

Inference

Running an already trained AI model to produce an answer, as opposed to the training that builds it. When you ask a local model a question, that is inference. On a Mac, it draws on Apple Silicon’s CPU, GPU and Neural Engine. Local inference needs no network connection and sends nothing outside.

Ollama / LM Studio / MLX

Three ways to run an AI model locally on a Mac. Ollama is a simple command line tool that downloads and starts a model in one command. LM Studio is an application with a graphical interface, handy for discovering, downloading and testing models without touching the terminal. MLX is Apple’s machine learning framework, designed to make the most of Apple Silicon and unified memory, more technical but faster. All three give you 100% local AI, with no data leaving the machine.

SS7 (Signalling System 7)

Set of protocols that lets telephone operators around the world talk to each other: routing your calls and texts, locating you when you switch cell towers, handling roaming abroad. Designed in the 1970s for a handful of national operators who trusted each other, it has no serious authentication. The result: a third party who obtains access to the signaling network can locate a phone or intercept its texts anywhere in the world, without touching the device. Used in 2G and 3G, extended by Diameter in 4G, which inherits the same weaknesses.

Diameter

The signaling protocol of 4G, successor to SS7. It does the same job (roaming, location, authentication between operators) with a more modern syntax, but reproduces the same model of implicit trust. In practice, many networks never deployed the encryption the standard provides for (TLS/IPsec), so the location attacks known on SS7 have their Diameter equivalent.

SIMjacker

Attack that exploits a piece of software present on some SIM cards (the S@T Browser) through a silent binary SMS: the message never appears on screen but runs hidden commands on the card, for example retrieving your location and sending it back to the attacker. Unlike pure SS7 attacks, which target the network, SIMjacker hits the SIM card of the targeted device directly.

Global Title leasing

Commercial practice where an intermediary leases a legitimate interconnection address on the global signaling network (a “Global Title”) to a third party. For a surveillance company, it is the way in: going through a small complicit operator or a broker, it obtains an access point that lets it query a target’s network remotely, without the consent of that target’s operator.

Telecom interconnection

All the technical links that let the networks of different operators talk to each other, so that your call or your text arrives even if the person on the other end is with another operator, in another country. This layer, invisible to the user, is exactly what SS7 or Diameter style attacks exploit: the vulnerability is not in your phone, but in the trust these networks extend to one another.

Open-weight

Said of an AI model whose weights, the billions of numerical parameters that make up the trained model, are published and freely downloadable. You can grab it, run it at home, modify it. Watch out for the common shortcut: open-weight is not open source. The weights are open, but the training data, the training code and the full recipe most often stay closed. That is what separates a Mistral or a GLM, which you can run locally, from a GPT or a Claude, reachable only through the provider’s API.

Template injection

Flaw that exploits a template engine, the component that assembles a page or a configuration file from a template and variables. If the application inserts a user supplied value into the template without neutralizing it, the attacker slips in not text but instructions, which the engine dutifully executes server side. The outcome ranges from leaking internal variables to remote code execution. It is one of the two vectors used against Hugging Face in July 2026.

Zero-day

Flaw unknown to the software vendor, and therefore with no fix available at the time it is exploited. The name comes from the count: the vendor has had zero days to fix it. It is the most feared category, because no update protects you and no antivirus knows the signature. Once the flaw is made public and patched, it stops being a zero-day and becomes an ordinary vulnerability, dangerous only for those who have not updated.

Privilege escalation and lateral movement

The two acts that follow a successful intrusion. Privilege escalation is going from ordinary access to administrator access, by exploiting a flaw or a badly set permission. Lateral movement is then moving from machine to machine inside the network, reusing the credentials picked up along the way. An attacker rarely gets in right where the thing they want sits: they come in through the weak link, then work their way up. Which is why the first intrusion matters less than what it lets them reach afterwards.

TCN (Technical Capability Notice)

Technical injunction from the British government, issued under the Investigatory Powers Act, that forces a company to build a capability to access data, including encrypted data. Its very existence is covered by legal secrecy: neither the targeted company nor the government has the right to publicly confirm that a TCN has been issued. It is the tool London used to go after Apple’s encrypted iCloud backups.

IPA (Investigatory Powers Act)

British law of 2016 framing the state’s surveillance powers, nicknamed the “Snoopers’ Charter”. It is what authorizes Technical Capability Notices and imposes the legal silence around their issuance. It acts by secret national injunction, not by public legislative debate.

IPT (Investigatory Powers Tribunal)

Specialized British court that hears challenges against the surveillance powers exercised under the Investigatory Powers Act. It is before the IPT that Apple is contesting the TCN targeting its iCloud backups, just as Privacy International and Liberty are contesting the regime governing these notices.

This glossary grows with every new article.