• 0 Posts
  • 156 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle

  • For the most part it’s not useful, at least not the way people use it most of the time.
    It’s an engine for producing text that’s most like the text it’s seen before, or for telling you what text it’s seen before is most like the text you just gave it.

    When it comes to having a conversation, it can passibly engage in small talk, or present itself as having just skimmed the Wikipedia article on some topic.
    This is kinda nifty and I’ve actually recently found it useful for giving me literally any insignificant mental stimulation to keep me awake while feeding a baby in the middle of the night.

    Using it to replace thinking or interaction gives you a substandard result.
    Using it as a language interface to something else can give better results.

    I’ve seen it used as an interface to a set of data collection interfaces, where all it needed to know how to do was tell the user what things they could ask about, and then convert their responses into inputs for the API, and show them the resulting chart. Since it wasn’t doing anything to actually interpret the data, it never came across as “wrong”.



  • The whole tactical-style-for-not-tactical-thing makes me rage. Not because it exists, but because it’s been picked up by the wrong demographic.

    That sort of thing should belong to the realm of the ironic, and be worn by the person who has a bad joke to go with it.

    Tactical baby carrier should be for the fun dad who uses it to make jokes about how you otherwise might notice the baby, and not the fragile guy who needs a shield to defend his masculinity in the face of raising his children.

    It’s like so much of these things started as a gag, and then got picked up by people who aren’t in on the joke.


  • Depends on the vendor for the specifics. In general, they don’t protect against an attacker who has gained persistent privileged access to the machine, only against theft.
    Since the key either can’t leave the tpm or is useless without it (some tpms have one key that it can never return, and will generate a new key and return it encrypted with it’s internal key. This means you get protection but don’t need to worry about storage on the chip), the attacker needs to remain undetected on the server as long as they want to use it, which is difficult for anyone less sophisticated than an advanced persistent threat.

    The Apple system, to its credit, does a degree of user and application validation to use the keys. Generally good for security, but it makes it so if you want to share a key between users you probably won’t be using the secure enclave.

    Most of the trust checks end up being the tpm proving itself to the remote service that’s checking the service. For example, when you use your phones biometrics to log into a website, part of that handshake is the tpm on the phone proving that it’s made by a company to a spec validated by the standards to be secure in the way it’s claiming.


  • Package signing is used to make sure you only get packages from sources you trust.
    Every Linux distro does it and it’s why if you add a new source for packages you get asked to accept a key signature.

    For a long time, the keys used for signing were just files on disk, and you protected them by protecting the server they were on, but they were technically able to be stolen and used to sign malicious packages.

    Some advanced in chip design and cost reductions later, we now have what is often called a “secure enclave”, “trusted platform module”, or a general provider for a non-exportable key.
    It’s a little chip that holds or manages a cryptographic key such that it can’t (or is exceptionally difficult) to get the signing key off the chip or extract it, making it nearly impossible to steal the key without actually physically stealing the server, which is much easier to prevent by putting it in a room with doors, and impossible to do without detection, making a forged package vastly less likely.

    There are services that exist that provide the infrastructure needed to do this, but they cost money and it takes time and money to build it into your system in a way that’s reliable and doesn’t lock you to a vendor if you ever need to switch for whatever reason.

    So I believe this is valve picking up the bill to move archs package infrastructure security up to the top tier.
    It was fine before, but that upgrade is expensive for a volunteer and donation based project and cheap for a high profile company that might legitimately be worried about their use of arch on physical hardware increasing the threat interest.







  • Attributing loosing or making preposterous strategic mistakes to some sort of 5D chess is a weird choice to make.

    I don’t know why so many of you people have such a hard time accepting that the popular conception of Russia as an Eastern counterpart to the US was inaccurate. Turns out that if you consistently invest less in your military equipment and personnel, you have a less capable military. It’s been 40 years since their expenditures have been comparable, and quite frankly it shows.

    Using your old equipment for an invasion would actually be a pretty novel strategy. Ukraine consistently used the best equipment available to them. That that was leftover NATO hardware doesn’t mean Ukraine was choosing to hold the good stuff in reserve.

    If they’re trying to use a “let the reservists die and then send in the competent soldiers” strategy, it doesn’t seem to be going very well. They’re somehow not holding the territory they took very well, and churning through a lot of what was presumably reserve hardware.

    Failing to execute a gulf war 1, and so deciding to chill in a Vietnam situation for … Some reason … for an indeterminate period of time is just not a strategy that any sane strategist would pick.

    If Russia has the ability to just handwave their way to victory if things got too rough, they’ve done a pretty terrible job of demonstrating it.
    I honestly can’t comprehend what you might have seen of this whole affair that would make you think they had that ability, beyond clinging to the notion that a former superpower must still be a superpower.
    They just don’t have the economy or the equipment to be able to afford to burn through endless waves of soldiers like you seem to think they’re intentionally doing.
    They didn’t even get air superiority, which is just embarrassing.



  • An all out war is unlikely, since if NATO involvement was going to kick that off it would have done so by now.
    The next point of escalation that could start something bigger would be stuff like NATO openly sending troops or actively providing fire support.

    US hesitation to allow our hardware to be used for this type of attack is much more to do with the political issues surrounding the war being framed as a proxy war instead of defensive support.
    The electorates support for “saving the day” and “superior US hardware helping keep a country free” is high. Support for a protracted and complex proxy war without clear right and wrong sides is exhausting and hits too many Iraq/Afghanistan buttons for people to care.

    Asking for and publicly being denied permission to bomb targets adjacent to the capitol does just as well at communicating “we can bomb your capitol” as actually doing it.


  • There seems to have been some policy miscommunication between political and military parties of both nations.
    The US has maintained that the restrictions have been to not allow offensive use, or specific long range missiles for targeting well inside Russian territory.
    Ukraine understood this to mean using them to fend off an attack, and only targets within a specific distance from the border.
    In the past few months it seems that much of this has been clarified, and Ukraine is now using US munitions for a proper US “preemptive defensive action inside enemy territory”, because a Russian base in Russia is full of Russian soldiers who will be ordered to attack, therefore an attack is defensive.

    If it was an actual miscommunication or a pivot is unclear, but the US language seems to have not changed, and a policy that acknowledges that almost anything Ukraine does in this war is inherently defensive is much more reasonable.


  • It’s also thought but not confirmed to be used for parallel construction. If the information is collected through illegal or inadmissible means, the NSA can inform the relevant agency that they have reason to believe that the individual is doing “illegal activity in question” and relevant details. The agency, now knowing the conclusion, can use legal means to gather the needed evidence for something they otherwise would never have even looked at.
    The NSA isn’t supposed to monitor anything on US soil that doesn’t involve both terrorism connections and communication with foreign parties, but due to “reasons” they regularly collect a lot of stuff that isn’t that, and they’ll (likely) inform the DEA.

    It’s a preposterous violation of the 4th amendment, but it’s also nearly impossible to prove.


  • I think concerns about China in specific are overblown.
    That being said, what we’ve learned about the topic from US tracking programs (slight chuckle at China having scope or abilities beyond anyone else in that regard) is that all information can be fed into what is essentially a statistical model of interests, behaviors, expressed opinions, and contacts.
    From that, you can determine a few things that are specifically “useful”.

    The first useful thing is the ability to tell if someone’s behavior has changed in an unexpected way. If someone starts talking to someone new via text message and they “shouldn’t” know each other (no common acquaintances, never at the same place at the same time, no shared interests) you have an anomaly that can be processed further.

    The next useful thing is once you have this model of expected behavior you can start modeling stuff like “A talked to B, B to C and then C changed behavior. A talked to D and D talked to E, and E changed behavior”, and more or less direct chains.
    This effectively tells you that A is influencing the behaviors of C and D. By tracking how influence (and money and stuff) flows through a network of people, you can extrapolate things like leadership, communication pathways, and material support pipelines. If you’re the US, you can then send a seal team to shoot someone.

    If you’re, supposedly, anyone doing this you can more selectively target people for influence based on the reach that it’ll have, use your models to target them better, and generally improve the quality of your attempted influence.

    I personally have my doubts it’s being used that way because it’s just as effective and far cheaper to hire a public opinion research group to pay a significant sample of people $5 to figure out how to make better propaganda, and then like 75¢ each to get Facebook to target the right people.
    It’s really only valuable if you eventually care about an individual. Most unfortunate privacy violations are aggregates.

    Even if it’s not directly actionable or a threat, you should still be wary about letting your browsing habits leak because the information can much more plausibly be used for phishing purposes.
    If you just bought some clown outfits and get an email about your clown plants being held at customs you’re a lot more likely to click to figure out what’s going on.




  • Paul Eggart is the primary maintainer for tzdb, and has been for the past 20 years.
    Tzdb is the database that maintains all of the information about timezones, timezone changes, leap whatever’s and everything else. It’s present on just about every computer on the planet and plays an important role in making sure all of the things do time correctly.

    If he gets hit by a bus, ICANN is responsible for finding someone else to maintain the list.

    Sqlite is the most widely used database engine, and is primarily developed by a small handful of people.

    ImageMagick is probably the most iconic example. Primarily developed by John Cristy since 1987, it’s used in a hilarious number of places for basic image operations. When a security bug was found in it a bit ago, basically every server needed to be patched because they all do something with images.