gshc2020.com

But to answer the big question posed up top: It looks like it is indeed pretty darn easy to hack Flock cameras, according to those who claim to have done it. But if you ask Flock about it, they'll tell you that while findings are legitimate, the situation with real, on-duty cameras isn't quite that straightforward and that the Flock system has never suffered a real breach.

Back in November 2025, cybersecurity pro and lifelong hacker Jon "GainSec" Gaines published a white paper on GitHub detailing Flock's vulnerabilities, which were explored in a YouTube video by Benn Jordan. The long and short of it is that after Gaines, uh, gained physical access to a Flock camera device purchased online secondhand, a simple procedure consisting of button presses, connecting to a network, and terminal commands gave him access to the camera's internal data and allowed him to "install whatever the hell you want on it." As one would gather from the title of Jordan's video, this process takes less than 30 seconds, and the things a malicious party could do with this level of access are only limited by their own imagination.

But wait, there's more

Gorodenkoff/Getty Images

Another concerning discovery (discussed at 7:09 in the video) was Flock not requiring multi-factor authentication (MFA) with all of its police department clients. You're probably familiar with multi-factor (or two-factor) authentication as that thing where you have to verify your identity by putting in a code texted or emailed to you when logging into a new online service, or logging into an existing service on a new device. Flock said that 3% of its law enforcement customers declined to turn on MFA, and it took until August 2026 for it to release an update that mandated its use across the board.

What's more, despite Flock claiming that Flock cameras only save images of license plates and all data and footage is always encrypted, Jordan caught the camera he tested saving pictures of himself, even when there were no plates in view (11:45 in the video). At 12:09, he also reports not having to "crack or decrypt a single thing" in the whole process of verifying Gaines' research.

Another hacker group did it, too

Max Acronym/Shutterstock

Jordan's video is thorough and goes on to show how researchers used "dorking" to expose API keys that granted access to private data such as live patrol car locations, officer info, and "hot list" license plate records. A "TEMPEST attack" can apparently expose video feeds from several feet away via electromagnetic leakage. Oh, and Flock hardware is said to run on a very old version of Android that doesn't even get security updates anymore.

More recently, hacker collective stegan0gram conducted a similar exercise, taking down an active Flock camera (very illegal, do not try at home) and copying the data within. They were apparently able to access an on-device encryption key and a bunch of data, which was shared to 404 Media and Wired for an investigation. They also discovered software that "explicitly detects people," despite Flock cameras being officially billed as automated license plate readers.

As for the next natural question of, "Okay, but are bad actors actually hacking Flock cameras and doing bad stuff?" at 3:08 in his video, Jordan allegedly found what appeared to be access to the Flock system offered for sale on a Russian-language "semi-private community" on the dark web. A translation of the post revealed text advertising "license plates, background checks, and vehicle tracking!" plus "direct police accounts in key U.S. regions" and "nationwide access."

Flock's response

Tigarto/Shutterstock

In direct response to Gaines' white paper, Flock published a blog post saying that it's been in contact with Gaines, has registered the vulnerabilities discovered appropriately, and then chose to highlight the following sentence: "Overall, none of the vulnerabilities detailed in the report have an impact on our customers' ability to carry out their public safety objectives." In case you're confused, "customers" in this context refers to the police.

As if that wasn't tone deaf enough, Flock continued, "Exploitation of these vulnerabilities would not only require physical access to a device, but also require intimate knowledge of internal device hardware." Unrelated but related: Stealing a car also requires physical access to said car, plus "intimate knowledge of internal device hardware," but that's not a legit reason for, like, Toyota to stop making car doors that lock.

Later in January, Flock came out with another post saying that its system has never fallen victim to a real breach. "No, Flock's cloud platform has not been hacked," the post read. "There has not been a leak of Flock information. Flock's cloud infrastructure has never been compromised. There has never been an incident in which customer data was accessed or exfiltrated by an attacker." The post went on to shout out Gaines' paper again and talk about how it's continuously improving to prevent hacks and data breaches — but not before calling the vulnerabilities Gaines found "theoretical" and "immaterial."

Who to trust?

Justin Sullivan/Getty Images

In March, Flock's recently-hired Chief Information Security Officer and NSA alum Chris Castaldo published a Flock blog post that addressed Jordan's November 2025 video head-on: "Flock's Product Security and Offensive Security teams evaluated the information submitted by this individual and determined that all of the findings were previously discovered by Flock's cybersecurity team and were already fixed or planned for engineering sprints throughout the remainder of 2025. While the findings were legitimate, they were all of low severity. Meaning the risk to customers or customer data was near zero."

He also says Gaines' device in question "was never deployed to a customer and never received any standard software or security updates that happen automatically when a device is registered with our cloud. Had this individual not prevented it from connecting to our cloud, most of their findings would have been moot. As the device would have applied pending updates that would have fixed known issues."

Unrelated but related: Late last year, at least 60 of Flock's Condor police surveillance cameras suffered a brief breach during which live feeds became accessible on the open internet, password free. In a short blog addressing that incident, Flock said the issue was down to an "isolated configuration issue" that affected "a very small number of Condor video devices." %!s()

I've been selling things since I was a child: candy bars, fidget spinners — you name it.

My middle school had a challenge to see which student could take a small investment of about $10 and make the most profit. I won, selling hooks to hang handbags on. I profited more than $1,000 over the six weeks of the challenge, although it was all for charity.

By the time I was about 14, I was reselling sneakers. Some kids have hobbies or play sports, but I would troll eBay, looking for deals that I could make a profit on. I reinvested what I made, and soon started camping out in line for exclusive sneaker drops. I might spend $200 on a pair of sneakers from the factory, then resell them for $1,000 later that night.

That was my whole weekend: sourcing items to sell. Sometimes I could convince my friends to come camp outside stores with me. My parents weren't too keen on the idea of me sleeping outside overnight, but they let me do it. I believe it made me a tougher person.

I'm making tons of money, but that's not what motivates me

If I sold three pairs of sneakers, I'd use the profit to buy five more. I viewed selling as more of a hobby than a job. Still, it was taking up a lot of my time. I didn't study much and found any excuse I could to get out of school. By about 17, I was all in on the business.

That was four years ago, and the business has grown massively. Today, I do five figures of sales each month, and in May, I hit a record: more than $280,000 in one month.

Money isn't my main motivator. The industry of reselling online via live-streaming is still young, especially in the UK, where I'm based. I'm chasing that top spot in the industry because it's still up for grabs.

Friends have drifted because I'm so focused on work

Being so dedicated to work impacts all areas of my personal life. I used to go to watch my favorite football team with my friends every week. Now, I haven't seen a game in probably three years.

Unsurprisingly, my friends have drifted away. I'm not still friends with anyone I went to school with. I did a vacation with a new group of friends and had a great time, but for the next two years, I didn't want to take time off work to join their trip.

I just turned 21, and my parents hosted a party beginning at 5 p.m. on a Sunday. I worked until 7, and was late to my own birthday. My parents wish I wouldn't work so much, but I'm all gas, no brake. I figure that I can be on a yacht at 40; I don't need to be there at 20. I want a family, eventually, but not for a long time.

I don't see myself slowing down

Since I'm working all the time, I don't spend much money. Despite selling high-end sneakers, I don't spend much on clothes for myself. I'm wearing a $30 pair of sneakers today, and they're worn out. I also still live at home with my parents. I'll do that until they kick me out.

Last year, I bought two rental properties. I paid cash, so I don't have a mortgage. Other entrepreneurs have told me to invest when I'm young. Real estate is my way of doing that. I've invested a little in stocks, but mostly want to stick to what I know, and that's real estate. I'm a simple man.

Too many people my age are focused on instant gratification, but I'm the opposite: I want to build my wealth now. I get my thrill from watching the business grow, not from spending money.

Right now, I'm happy working full throttle. I'll do that until I hit a wall. I don't see any reason not to. I know I put a lot of pressure on myself, but I'm young — I have time to make mistakes.

Read next

Kelly Burch

You're currently following this author! Click to unsubscribe from email alerts.

Kelly Burch has been writing about personal finance for more than a decade.She's particularly interested in how finances impact the most intimate parts of a person’s life, from educational and reproductive choices to love, immigration, or estate planning. Kelly has written about these topics personally and explored them with experts, including entrepreneurs, multi-millionaires, financial planners, and more.Kelly is a first-generation college graduate and homeowner who integrates her personal experience creating financial stability into her reporting. She’s a career journalist, with work appearing in “The Washington Post,” “The Chicago Tribune,” “Boston Magazine” and more.Kelly lives in rural New Hampshire with her husband, two children, and two dogs. When she’s not behind her desk, she can be found getting lost in the mountains and lakes around her home.Follow her on Facebook or Twitter, or learn more here.   

• as told to
• Sneakers
• Small Business Insider
• More
• side hustles

At Minecraft Live, we learned that a new dimension from Minecraft Dungeons 2 will be added to Minecraft in 2027

Image: Mojang

Sign in to your Polygon.com account

In the wake of layoffs and studio reshuffling at Xbox earlier this week, Mojang held a Minecraft Live showcase to make several Minecraft-related announcements. While we didn't get a look at the next movie, Mojang revealed a game-changing addition to Minecraft. Next year, the Sift dimension from Minecraft Dungeons 2 will come to the survival crafting game, marking the first time a new dimension has been added to Minecraft since it hit 1.0 in 2011.

What was announced at the September 2026 Minecraft Live?

Mojang gave us a first look at the Sift at Minecraft Live and confirmed it will be added to Minecraft Java Edition and Minecraft Bedrock Edition in 2027. Before then, the Sift will play an important role in Minecraft Dungeons 2, a Diablo-like action-RPG spin-off set to launch on Sept. 29. From Minecraft Dungeons 2's segment of Minecraft Live, we can tell the Sift is an ethereal, spirit-world-like dimension.

Currently, Minecraft consists of three fairly ubiquitous dimensions: the Overworld, the Nether, and the End. By the time the game exited its public alpha and beta testing in Nov. 2011, all three of those dimensions were part of the game. In the nearly 15 years since, Mojang has simply expanded the content available in those dimensions rather than adding any new ones. That'll finally change next year.

While that's certainly the highest-profile announcement from this Minecraft Live, the reveals didn't stop there. Mojang showed how the next game drop will add ice caves as a new underground biome. In ice caves, players can fight the new Frozen Zombie mob, equip and craft the ice balls those enemies fight with, and mine ice crystals.

Image: Xbox Game Studios

Sound Effects packs will also come to the Minecraft Marketplace by the end of the year. As for the new announcements outside the game, we learned that Chessington World of Adventures' upcoming Minecraft World theme park will include a coaster called Escape the Nether and open alongside a Minecraft-themed hotel in 2027.

A Wilderness Bound community challenge announcement and a tease for a more robust "creator platform" for those who make in-game Minecraft content were also made during Minecraft Live.

Finally, Mojang reiterated that Minecraft will launch on Nintendo Switch 2 on Oct. 27, adding to the large number of platforms the game is already available on. It certainly seems like quite a busy and fruitful time to be a Minecraft fan. %!s()

Gray has a long history with the festival, having closed it with The Lost City of Z and marked its anniversary with a special screening of Armageddon Time. But still, this felt different — as Gray himself noted in his moving introductory remarks, reflecting on growing up a few miles away from the Upper West Side. He remembered, after telling his parents he wanted to become a movie director, their skeptical reply: “How are you ever going to do that?” Gray then looked to the full house inside the theater and said, visibly taken aback: “Well, here I am.”

The general feelings around Paper Tiger feel distinct from Gray’s past films as well. Although a consistent critical darling, the Queens native hasn’t been able to break into the Oscar race in his career thus far, and at this point seems overdue — certainly, it wasn’t hard to think so hearing Lim’s comments framing the relaunch of Paper Tiger, which has not screened publicly since its world premiere in Cannes. The film had been widely acclaimed on the Croisette, and despite the jury overlooking the drama — as has, frustratingly, been a pattern for Gray’s movies at the festival over decades — it was being primed to roar with its fall launch by distributor Neon.

Indeed, this one has arrived with the bells and whistles that typically elude the rollout of a Gray movie; its mix of bold classical filmmaking and rich memoiristic undertones is ideal for placing the movie in the context of his career. In his introduction, Lim spoke about how difficult it is to make personal, independent American films in the current climate; earlier this month, he called Paper Tiger “miraculous” in an interview with The Hollywood Reporter for just that reason. In a season dominated by international directors and blockbuster hits, that framing stands out.

Paper Tiger stars Miles Teller and Adam Driver as Irwin and Gary Pearl, brothers in 1986 Queens, caught in a scheme that puts their family’s lives at risk. Gray’s tight screenplay weaves these crime-thriller bones into textured family drama, with the plot coming to hinge on Irwin’s wife, Hester (Scarlett Johansson), considering how best to protect her sons and ensure their future, while also contending with her own personal crisis.

Shown on a 35mm print at Lincoln Center, this North American premiere was warmly received, with the core cast all on hand. As THR reported last week, Teller will campaign as a lead in the film — Irwin’s POV opens and closes the film — with past Oscar nominees Driver and Johansson going supporting. The best-actor race may be too competitive for Teller to make much of a dent, but the transformational work of Driver and Johansson, who’ve earned raves for Paper Tiger, could gain traction (and help push the film as well) coming off of the NYFF momentum.

“We were on such a small set…and also it was extremely hot, and when you have a group of actors hanging around with everybody on top of each other — honestly, that’s a labor of love. You do it because you love to do it,” Johansson said in the post-screening Q&A. “You end up hanging out and talking and sharing stories and feeling closer…. You have to survive the day, and it’s hard making movies, and it’s very hard making movies [like this].” %!s()

Dozens of hours of content from this summer alone

Image: Larian Studios

Larian Studios has said goodbye to Baldur’s Gate 3. They’ve been clear about this: At a GDC panel in 2024, founder Swen Vincke said, “We’re not going to make new expansions, which everybody is expecting us to do. We’re not going to make Baldur’s Gate 4, which everybody is expecting us to do. We’re going to move on, we’re going to move away from D&D, and we’re going to start making a new thing.”

There’s a world in which that was the end of new Baldur’s Gate 3 content, full stop. That’s not the world we live in. Since late July of this year alone, at least four substantial custom campaigns have been released for the game. There’s a fifth fan-made campaign already in development. Three years after Baldur’s Gate 3’s release, and with the developer’s assurance that no new official expansions are forthcoming, the question now isn’t whether we’re going to get more content. It’s why we’re getting so much — and if any of that content is actually good.

Image: Larian Studios

Better dev tools can answer one of those questions. Larian’s official mod support was never built to allow full custom-campaign creation. Modders have figured out ways to build around that restriction, partially by using unlocked toolkits like Moonglasses. Larian's own editor ships with several key features disabled, like the ability to build brand-new levels, write new dialogue, or design new combat encounters…e.g., the foundational building blocks of a real campaign. Moonglasses and similar third-party mods remove those restrictions and allow modders to access developer mode within the game, granting them the ability to build new stories from scratch.

There’s also timing: One of these expansions, A Dream of Silence: ReVamped, was built specifically as an entry for the BG3 July Modathon 2026, an organized community event. That does indicate, for at least some of these mods, it’s not a coincidence that we’re seeing so many projects releasing at the exact same time. (For those interested, this does appear to be an annual event, so there’s a decent chance we’ll get a drop of expansions next year, too.)

But are these expansions any good? Depends on what you’re looking for. Each of the recent modded campaigns delivers something specific.

• A Dream of Silence: ReVamped drops you and Astarion into a shifting nightmare version of Cazador’s mansion, adapting an existing piece of interactive fiction into a six-hour, four-ending story about your choices to save him or let the nightmare win.
• The Sunless Citadel skips branching narrative choices almost entirely for a linear dungeon crawl, for those who don’t want to wade through dialogue and would rather get right to combat and exploration.
• Act Two Expansion widens, as the name indicates, Baldur’s Gate 3’s second section into an entirely new region, the Chionthar Wilds, with over 70 new items and 30 new fights.
• Dinner With Strahd goes the opposite direction from Sunless Citadel, granting players a new story and full voice acting for one self-contained encounter with an iconic Dungeons & Dragons villain.
• And — upcoming — we have Path to Menzoberranzan, which promises a full three-act campaign with its own companions and a new protagonist, set one century after the events of Baldur’s Gate 2.

Determining if each is good is in the eye of the player. Looking for voice acting? Play Dinner With Strahd. Seeking more lore and exploration? Act Two Expansion may be the way to go.

Image: Larian Studios

Again, these are not highly polished, official DLC experiences. Some of them do feel oddly disconnected from the rest of the base game — nothing you live through in the Act Two Expansion, for example, will influence your run’s Act 3. None of these expansions are available on console, at least at this time; each requires a PC install through Nexus Mods, since bigger campaign mods like these don’t currently meet the requirements for Larian’s official console-friendly in-game mod menu. And at least a couple of these mods are in flux or running alphas or betas pending further modder updates. The Sunless Citadel, for instance, doesn’t have a camp system yet (those are harder to build than you might think!). Further, if you’re interested in running more than one of these at a time, you may need to tread with care. A Dream of Silence: ReVamped's own documentation warns that running it alongside Dinner With Strahd can cause a glitch that unexpectedly swaps out some of Cazador's visuals.

Six hours from one campaign, seven or eight from another, a whole new region to explore in Act 2, and (my eye’s on you, Path to Menzoberranzan) entirely new characters and a full-game campaign in the works — the incredibly active and creative modding scene surrounding Baldur’s Gate 3 is keeping the tens of thousands of people constantly replaying this game busy. This is all real, playable content, available now, ready for your next run. Clear your schedule: For a game that’s not getting official DLC or expansions anymore, Baldur’s Gate 3 has a surprisingly vast library of ways to make replays feel brand-new, every single time. %!s()