Mysk is a security research team that publishes findings about privacy and vulnerabilities in iOS, macOS and popular apps, and builds the Psylo browser.
HN links it as the original source for reports on link preview privacy, Safari tracking and Apple's required reason API.
Most ways to collect boot time are a "Required Reason API," so they declare through NSPrivacyAccessedAPITypeReasons, meaning AppLovin apps are (unsurprisingly) lying about what they are doing with the data. There's a fair amount of research into this, for example at https://mysk.blog/2024/05/03/apple-required-reason-api/ and https://blog.appicaptor.com/2025/02/05/apples-required-reason-api-aftermath-after-one-year-in-practice/ (which also documents a workaround that Apple's static analysis tools didn't detect at the time).
My general conclusion is: it's stupid that Apple continue to allow this and Trust Us Bro is not a good permission system to allow app developers do shady things, especially when research indicates that they are, unsurprisingly, doing shady things. Apple's static analysis based App Store approval system is also historically swiss-cheesey and I know they could do better. Overall, thematically a black mark on Apple, which has always been surprising for me because they tend to genuinely care about privacy in many other facets.
article w/ overview of how various platforms handle link-previews
https://www.mysk.blog/2020/10/25/link-previews/
Discord: Downloads up to 15 MB of any kind of file.
Facebook Messenger: Downloads entire files if it’s a picture or a video, even files gigabytes in size. *
Google Hangouts: Downloads up to 20 MB of any kind of file.
Instagram: Just like Facebook Messenger, but not limited to any kind of file. The servers will download anything no matter the size.*
LINE: Downloads up to 20 MB of any kind of file. (This one still deserves a big as we’ll discuss later)
LinkedIn: Downloads up to 50 MB of any kind of file.
Slack: Downloads up to 50 MB of any kind of file.
Twitter: Downloads up to 25 MB of any kind of file.
Zoom: Downloads up to 30 MB of any kind of file.
1776183767 | iCloud Private Relay is not secure | https://webrtchacks.com/apples-not-so-private-relay-fails-with-webrtc/ | https://news.ycombinator.com/item?id=47767673
1785886306 | IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay | https://mysk.blog/2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/ | https://news.ycombinator.com/item?id=49176697
1785949588 | iCloud Private Relay leaks real IP addresses | https://proton.me/blog/icloud-private-relay-ip-leak | https://news.ycombinator.com/item?id=49185697
1787034453 | Apple sued after privacy feature failed to hide your data | https://www.techlicious.com/blog/apple-icloud-private-relay-is-subject-of-a-class-action-lawsuit1/ | https://news.ycombinator.com/item?id=49342056
I'd like Psylo [1] to be available on other platforms like Linux and MacOS. Psylo puts each tab behind a VPN and give them their own cookie storage space. It feels like a dramatically more private tool than Orion.
I tried Orion in Dec 2025 and it crashed more frequently than I could handle. It and/or VPNs I was using worked poorly with websites that I want to keep a page open on for days at a time.
[1] https://mysk.blog/2025/06/17/introducing-psylo/
iOS isn't free from this kind of snooping[1][2].
[1] "How popular apps can read your phone's clipboard without permission": https://www.mysk.blog/2020/03/10/popular-iphone-and-ipad-apps-snooping-on-the-pasteboard/
[2] "Popular iPhone and iPad Apps Snooping on the Pasteboard": https://www.telegraph.co.uk/technology/2020/03/30/popular-apps-can-read-phones-clipboard-without-permission/
Identical situation when Facebook was asked to not show previews of the news articles, because of the ePrivacy directive. Could this go for the same legistlation?
https://www.mysk.blog/2021/02/08/fb-link-previews/