• 0 Posts
  • 177 Comments
Joined 3 years ago
cake
Cake day: June 7th, 2023

help-circle


  • Google processes over 5.9 trillion searches per year

    That number has nothing to do with the problem. They don’t need to review every search, they need to review every advertising link they have been paid to place (not every link indexed). Presumably, they already have the infrastructure in place to track those links and verify that they comply with laws such as CSAM, copyright or other areas where they actually have some accountability in those areas. The number of paid advertisement links will be far smaller than that 5.9 trillion number.


  • And through inaction said public is consenting to be ruled by nasty Christian predators.
    How (and/or what) should thoughtful people think about the public’s consent to be ruled by elite Epstein class pedophiles?

    The world isn’t quite as black and white as you want to make it out. And the range of possible responses do not exist in isolation.
    Let’s start with the absurd response of “Annie, grab your gun and let’s go overthrow the government”. This would stupid on so many levels. First and foremost is the simple unlikelihood of success. While the wars in Vietnam and Afghanistan have demonstrated that the overwhelming force of the US Military has problems dealing with a dedicated insurgency, such insurgencies require a fanatical level of dedication on the part of the insurgents. Do you really think you and a million of your closest friends area ready to get blown apart by an Apache Gunship to force Trump out of office? So this is just a dumb idea.

    Moving on, you could always just go for targeted assassinations. You can be John Wilkes Booth all over again, though I don’t suspect Trump is as much a fan of live plays as Lincoln was. Maybe stalk him to a McDonalds? Ignoring all the logistical issues of actually getting to and assassinating a sitting President, it’s not like you would get much done. JD Vance isn’t all that much better (couches everywhere beware!), and the GOP has demonstrated that they are quite willing to keep coughing up horrible people for leadership positions. Really, the problem here is that we have a very divided country at the moment and a significant enough part of the electorate is just fine with a rapist, pedophile grifter as President.

    So, let’s take political violence off the table. The best outcome it offers is a civil war with maybe your side winning and maybe the US under the direct control of Ya’ll Qaeda. Or worse, a balkanized US locked in a modern version of the Hundred Years War.

    That leaves us with civil disobedience, general strikes and other protests. And I don’t want to downplay the impact these things can have; however, the US is a large, diverse place. A general strike in one State is unlikely to have a major impact in another. And coordinating a general strike across the entire US is very, very hard. Maybe that is the answer to your question, but the fact that it hasn’t been done yet lends some credence to the idea that it’s not really possible. If you think this is what is needed, then by all means, get out and start trying to organize one. Or work with existing groups to try and get one going, I wish you the best of luck, but I’m not going to be putting money down on your chances of success. Protests and civil disobedience can get attention, though that will only get you so far.

    All that above leaves the quiver pretty empty. And I’m going to point out the answer you don’t want to hear and will complain about: organize, advocate and vote when the option becomes available. Yes, the GOP has been running full throttle trying to hijack elections. And working within the American Democracy is slow, marginally effective at best and endlessly frustrating. But, unless you think you have the gumption to win a civil war (you almost certainly don’t), this is the system of government for the United States for the foreseeable future. It’s a terrible system, but better than the other stuff humans have tried.

    Of course, that means you are also stuck in the situation of “through inaction said public is consenting to be ruled by nasty Christian predators”. And that is partly true. One of the downsides of democracy and elections is that the people you disagree with will occasionally get into power and be able to push their ideas on society. That’s part of what it means to live in a functioning democracy. That the whole thing doesn’t devolve into civil war the minute one side or the other loses. We have boundaries written into law which define exactly how far any one party can go in implementing its agenda while in power. And we have some levers for the out of power party to push back on. But, the system is built on the idea that the peaceful transfer of power between parties who disagree is a far sight better than the non-peaceful transfer of power whenever one side of the other manages to out-violence the other.

    So ya, I hate that it’s true, but since I value a stable democracy, I consent to the orange shit running the country. Because the alternative isn’t some left-wing utopia, it’s constant civil war. If we want our country to look more like a left-wing utopia, we need to win enough people over to our ideas and implement those ideas when we hold power. It’s not hopeless, and it all entirely possible. But, it’s easy to just complain, give up and scream into the void that “voting never fixes anything”. But cynicism doesn’t solve problems, hard work does. And hard work isn’t fun, it isn’t sexy and it doesn’t play well on social media.


  • Actually, that’s the start of a solution.

    I’ve personally implemented something similar to this in the past. At one site we had an issue with people browsing porn on their office PCs. Some folks got pretty creative in getting around the blocks we had in place. However, we had full packet capture at the firewall; so, all of the evidence was there. I setup a system which pulled images above a certain size out of those packet captures and passed them through an open source image classifier which used a model based on machine learning. Anything above a certain threshold was flagged for human review, everything else was ignored. It wasn’t perfect, I looked as quite a few images of sand dunes, but it did 90% of the work. And sure, some false negatives likely got through. But, it let us run down the worst offenders.

    Right now, Google seems to be ignoring the problem and has no incentive to do anything about it. Google is directly profiting from those malvertising links and so should bear some responsibility for ensuring that they are not serving malware to users. We can certainly work out the fine details around their duty of care and how they can meet it (e.g. LLM scanning with human review), but holding our collective dicks with both hands and claiming “nothing can be done” because it would cost Google money is a bad answer.


  • It actually seems like a good place for an LLM. One of the security tools I work with uses an LLM to scan emails for malicious links and things like Business Email Compromise and Phishing. It’s actually pretty good. It seems like Google, et. al. could use something similar to catch some of the more obvious malvertising links. But, since they don’t have any accountability, they have no incentive. The only way to build that incentive is to start hitting them in the pocketbook. Letting them ignore the problem isn’t working.


  • And yet, they still serve malicious ads before the actual search results. Just ruined a user’s day over such an ad tricking them into running malicious code. You’d think their AI could figure out when an ad link is impersonating a legitimate site and not serve the malicious ad. But, since they aren’t held responsible for serving malicious links, they have a negative incentive to fix the problem.




  • Yup. Being young and stupid, a group of us were lighting those rose fireworks (the kind which spin and light up on the ground), putting them in a water balloon launcher and flinging them into the sky. While we were aiming for a river, this also meant we were aiming for some brush. Unsurprisingly, we eventually had one land short while still burning and started a bush on fire. We ran down and started trying to put it out with dirt. This wasn’t going well until we remembered we had a small container and a ready source of water (the river) and managed to douse the fire.




  • When you have a potentially volatile situation, lobbing bombs at it rarely makes it better. This wasn’t a “time bomb to explod[ing]”. This was a deliberate decision by Cheeto Mussolini to launch a foreign military adventure. While the current regime in Iran was far from ideal, it’s important to keep in mind why that regime was in place. The UK and US were directly involved in overthrowing the elected government in Iran in Operation Ajax. That resulted in a violent, repressive dictatorship. But it was friendly to UK/US oil interests, so that made it ok. When the Iranian people overthrew that government, the current Iranian government came to power.

    That the current administration expects a different outcome this time around is the height of stupidity. All this will accomplish is creating another generation of Iranians who hate the US due to direct experience.


  • That’s funny, while I still buy Samsung TVs, I hate their phones. So much of what their phones can do is usually locked to only working in Samsung’s apps and those are universally dog shit. The phones themselves are also often privacy and user control nightmares.

    Granted, there isn’t a lot of good choices for phones these days. I’m still running an old LG phone and have been looking outside Android as my next possible solution. But, I also haven’t had a reason to upgrade.






  • While I don’t know the specific post you are referring to, Malware exists for Linux. Here’s a great overview from last year. If someone wants to argue, “oh it’s from a security company trying to sell a product” then let me point you at the Malware Bazaar and specifically the malware tagged elf. Those are real samples of real malware in the Linux specific ELF executable binary format (warning: yes it’s real malware, don’t run anything from this site). On the upshot, most seem to be Linux variants of the Mirai botnet. Not something you want running, but not quite as bad as ransomware. But, dig a bit and there are other threats. Linux malware exists, it has for a long time and it’s getting more prevalent as more stuff (especially servers) run on Linux.

    While Linux is far more secure than Windows by design, it’s not malware proof. It is harder for malware to move from user space into root (usually), but that’s often not needed for the activities malware gets up to today. Ransomware, crypto miners and info stealers will all happily execute in user-land. And for most people, this is where their important stuff lives. Linux’s days of living in “security through obscurity” are over. Attackers are looking at Linux now and starting to go after it.

    All that said, is it worth having a bloated A/V engine doing full on-access scanning? That depends on how you view the risk. Many of the drive-by type attacks (e.g. ClickFix, fake tech-support scams) all heavily target Windows and would fail on a Linux system. The malware and backdoors that come bundled with pirated software are likely to fail on a Linux system, though I’ll admit to not having tested that sort of thing with Wine/Proton installed. For those use cases, I’d suggest not downloading pirated software. Or, if you absolutely are going to, run those file through ClamAV at minimum.

    Personally, I don’t feel the need to run anything as heavy as on-access file scanning or anything to keep trawling memory for signatures on my home systems. Keeping software up to date and limiting what I download, install and run is enough to manage my risk. I do have ClamAV installed to let me do a quick, manual scan of anything I do download. But, I wouldn’t go so far as to buy A/V product. Most of the engines out there for Linux are crap anyway.

    Professionally, I am one of the voices who pushed for A/V (really EDR) on the Linux systems in my work environment. My organization has a notable Linux footprint and we’ve seen attackers move to Linux based systems specifically because they are less likely to be well monitored. In a work environment, we have less control over how the systems get (ab)used and have a higher need for telemetry and investigation.


  • Let’s ignore the pedantic issues of “there is no surface”, “there is no sun to rise” or “you’d be dead so insanely fast you probably wouldn’t notice”. Assuming you were magically teleported and held protected just above the event horizon of a black hole, it would be so bright you’d go blind almost instantly. Not because of any star coming over the horizon, but because the accretion disk would just be that bright. If you look at NASA’s pictures of M87, you aren’t actually seeing the black hole. There’s nothing there to see. Instead, what you are seeing in the pictures is the accretion disk around the black hole. As matter gets closer to the event horizon, it accelerates and all that stuff starts bumping into each other. At the energies involved, this produces electromagnetic radiation of basically every energy. There is infrared right up through x-ray, included lots and lots of visible light. And this is happening on a scale which is so mind mindbogglingly big that words really just fail to capture it. Here is an artistic representation with our solar system for scale. Pluto’s orbit would be well inside the event horizon. There is an insane amount of light and energy in that accretion disk. And thanks to the blackhole warping light around itself, you would be getting bombarded by its energy from every angle, including the disk on the opposite side of the black hole. In short, it would be really bright.