Posts by Sora2566

Japan to probe Google over 'suspicion' that antitrust laws are being broken

Here's hoping *somebody* stands up to Google before the sun burns out...

US government's Login.gov turns frown upside down, now smiles on facial recognition

Oh for pity's sake... just use passkeys, and require user verification. You'll get more security with far better privacy outcomes.

Australia threatens X with fine, warns Google, for failure to comply with child abuse handling report regs

https://www.abc.net.au/news/2023-10-16/social-media-x-fined-over-gaps-in-child-abuse-prevention/102980590

Quoting directly from there:

The eSafety commissioner, Julie Inman Grant, can now require online service providers to report on how they are meeting any or all of the expectations as part of the eSafety Act.

"This was about the worst kind of harm, child sexual exploitation as well as extortion, and we need to make sure that companies have trust and safety teams, they're using people processes and technologies to tackle this kind of content," she told ABC News Channel.

"Frankly, X did not provide us with the answers to very basic questions we'd ask them like, 'How many trust and safety people do you have left?'"

Worth noting that one of the questions that Twitter/X refused to answer was "how many people do you have working on eSafety".

I suspect the answer is suspiciously close to "Zero".

SBF on trial: The Python code that allegedly let Alameda hedge fund spend people's FTX deposits

Re: Sure, take $10B from customer accounts without their knowledge or consent

How about we put away the pitchforks and torches for now, and let the courts do their work? Being angry is fine, wishing violence on people isn't.

Forcing Apple to allow third-party app stores isn't enough

Re: It's not whether the App Store is good or bad...

"What class of apps is Apple blocking that threatens them? I can't think of anything."

According to app store rules, anything that does something that an Apple device does already cannot be an app. Most famously, this means that web browsers cannot be installed via the app store, as they -gasp- might actually prove a superior experience to Safari, which comes installed with the device.

Yes, Chrome and Firefox have apps in the app store, but those aren't browsers - they're thin wrappers around Safari. There is no choice of browser on iOS - it's Safari or nothing. That's why Safari being underpowered is such a problem - another browser cannot just outcompete it, because it can't compete with it period. They've banned browser competition on iOS.

'Gay furry hackers' brag of second NATO break-in, steal and leak more data

"Gay furry hackers"

"Telegram"

I wouldn't have thought that those two would really go together...

EFF urges Chrome users to get out of the Privacy Sandbox

Re: Six of one and half a dozen of the other

The trouble is that Google is saying there are only two choices: third-party cookies or the privacy sandbox. And between them, the sandbox is better... slightly.

But what the EFF is saying, is that they've left out the choice of "not having targeted ads", which is superior to both by ages.

Amazon accused of being a monopolist in FTC lawsuit

Re: Private Jets, that's the problem

So police should only ever go after small offenders, as going after major offenders is just going to "make a lot of noise" and "make things worse"?

Yes, other people do this. It's illegal, and should be stopped.

Amazon being a major player who does this makes this *more* important to stop, as it's committing the *actual, literal crime* at a massive scale. If people look at Amazon as normal, why should they not do the same thing? Commit the same crimes?

Re: Private Jets, that's the problem

"Someone else is worse" is the argument of somebody who knows full well that the entity being discussed cannot be defended otherwise.

T-Mobile US exposes some customer data – but don't call it a breach

Kids, here's the best advice you'll ever hear for avoiding cypto scams:

Don't buy crypto.

Australia to build six 'cyber shields' to defend its shores

The minister's goal is that "just as you can't go into a car yard and buy a car that will not be safe to use, when you buy a digital product on sale in our country we know that it's safe for you to use";

I feel like this will be the hardest one of all - given that anything powerful quickly becomes unsafe.

China to set standards for the metaverse because it's not sure what one is

I bet China wants to set Metaverse standards just so that people look to them as an authority, not because they seriously think it's going anywhere.

If anyone finds an $80M F-35 stealth fighter, please call the Pentagon

Re: I could have understood not mentioning it if it was a Starfighter

People keep saying the F-35 is a failure, which is a bit weird, given that almost all the information on its performance is classified, so the only people able to make that call should be working at the Pentagon...

Google throws California $93M to make location tracking lawsuit disappear

You mean like how phone services in America noticeably improved after the breakup of the AT&T monopoly?

Scientists trace tiny moonquakes to Apollo 17 lander – left over from 1972

NASA uses the metric system internally, though?

That actually cost them a mission, as the part they commissioned from Lockheed-Martin measured force in pounds, rather than Newtons. https://everydayastronaut.com/mars-climate-orbiter/

Get ready to say hello to new Windows and goodbye to an old friend

Re: They work?

The network troubleshooter's gotten me back online, like... twice. Out of hundreds of problems I've had, but still.

Google Chrome Privacy Sandbox open to all: Now websites can tap into your habits directly for ads

Re: Sneaky

I believe Firefox now supports a somewhat locked-down version of the Web Serial API, now.

Microsoft: China stole secret key that unlocked US govt email from crash debug dump

Re: "another issue it said has now been corrected"

Y'know, when most people ask for a corporate manage to fall on their sword, they mean figuratively...

Microsoft calls time on ancient TLS in Windows, breaking own stuff in the process

Sadly, we live in a world where all sites NEED to be using HTTPS. https://doesmysiteneedhttps.com/

Brain-computer interface and AI helps stroke victim speak through avatar

The patient in question could still move her facial muscles, so...

"Blink twice if that's mostly what you meant, blink three times if not, one long blink for 'It's complicated'".

Here's one use of a brain interface I'm happy to see being researched - here's hoping they can get that error rate down further.

Get a $25 gift card if you help the US check whether these facial logins really work

"Oh yeah, I'm sure actively helping the government implement facial recognition of all of its citizens will lead to only good things"

- nobody ever

I'd suggest some kind of WebAuthn alternative, but you can pass those from person to person, so no dice if you want to be sure the person before the keyboard *is* the relevant person. Mind, we have that problem with passwords now, and the world had not collapsed...

Microsoft DNS boo-boo breaks Hotmail for users around the globe

I really, really hope you mean TSL certificates.

Moscow makes a mess on the Moon as Luna 25 probe misses orbit, lands with a thud

Wonder what all those guys who were screaming about "Sanctions don't work! Russia is going to the moon!" think now?

Shifting to two-factor auth is hard to do. GitHub recommends the long game

Re: Opt-Out

Let me tell you a story about an NPM package called 'left-pad'... https://www.theregister.com/2016/03/23/npm_left_pad_chaos/

Re: Opt-Out

That's a little callous if a hundred people have dependencies on your code - then it starts looking like a juicy target for a supply-chain attack.

Attackers do not need access to your phone to intercept your text messages. They just need a convincing story and a phone repair shop that isn't paying attention.

Google's next big idea for browser security looks like another freedom grab to some

Re: Why this isn't needed. (A micro essay)

I agree with you in principle, but WebAuthn just means that the client has a public/private key pair. Chrome has an emulator for this built in for testing, someone making a fake browser can make fake WebAuthn accounts no problem. "Guaranteeing that the user is real" isn't WebAuthn's purpose - it's making sure it was the same user as last time.

Australian court orders Meta subsidiaries to pay $14 million over data use

Re: Wot?

The worse part is that the court *could* have asked for billion dollar fines - the law allowed them to issue a million-dollar fine *per infraction*.

Guess who's quietly bankrolling a legal fight against Montana's TikTok ban. Why yes, it's TikTok

Re: It doesn't matter where it is stored, it matters who has access to it

It's not that we have proof that they *are*, it's that we have proof that they *could* - the CCP has passed laws that given themselves those powers. That's apparently enough to make the US gov go *heck no*.

Re: Data in America not being safe, well no. That's why the EU are currently fighting with Google and Facebook in the courts about storing EU citizen data in the US, as they don't consider that secure for many of the same reasons as America is worried about data in China.

Chinese balloon that US shot down was 'crammed' with American hardware

Re: Notice how....

Taking your hands off the steering wheel will do nothing to steady the course of the car.

The death of the sysadmin has been predicted for years – we're not holding our breath

Re: Biased A.I models written by white men

That's not 'Woke', that's 'noticing that facial recognition doesn't seem to work as well for brown people' and 'noticing that voice recognition doesn't seem to work as well for people who don't have American accents'.

You know, observing reality.

Montenegro jails Do Kwon, accused of causing $40 billion LUNA crash

I take it Montenegro doesn't have extradition treaties with the nations that want this guy?

Scientists think they may have cracked life support for Martian occupation

Re: How about plants ?

In fairness to Andy Weir, they figured out that Mars's atmosphere is too thin for storms roughly about when the book was published (too late to rewrite the plot).

Australian cyber-op attacked ISIL with the terrifying power of Rickrolling

Should the Aussies be proud or ashamed?

Pakistan turns its back on crypto to keep anti-terrorism watchdogs happy

Re: I feel bad for Pakistanis

Yes, because if there's one thing Bitcoin's famous for, it's how its value remains stable. /s

Go ahead, forget that password. Use a passkey instead, says Google

Usually it's less developers being completely uninterested and more managers being completely uninterested... and if the developer somehow manages to get that through, the users being completely uninterested in learning a new way of doing things.

While I agree that the current inability to move passkeys between tech ecosystems is their biggest weakness, calling them "a password locked up in some magical device" is a bit misleading. Said magical device won't ever send that "password" to a typosquatting domain, which kills entire swathes of attacks right there. Also, as they're a public/private key pair, you have pretty much no chance running dictionary, brute-force, or credential stuffing attacks.

I'd call them "a password++ locked up in some magical device" myself.

Re: Oh boy here we go

Apple and Google are working on making that "token-generating dongle" be your smartphone. And while there's still issues about proprietary hardware and biometrics not recognizing you... these are the same problems we already have with our smartphones. The goal here is to make those the *only* login-related problems, rather than those *plus* all the problems with passwords.

Microsoft disarms push notification bombers with number matching in Authenticator

Re: Security vs Convenience

Yes, but sometimes all an attacker needs is one idiot. Hence the attempt at idiot-proofing.

Even if they do it once an hour, if they do that every hour for a whole week...

If you're struggling to secure email forwarding, it's not you, it's ... the protocols

That means that the FROM header hasn't been changed since the email was sent, not that the email was really sent from that account. The only "authentication" this process provides is proving that the email was sent from *somebody* with access to that domain's private key, not a particular person.

99 year old man says cryptocurrency is for idiots

Re: Value

My understanding is that currencies get their value from the fact that you can pay taxes with them. Then, once everyone agrees they want the currency (if only to avoid the taxman breaking down their door), everyone agree that the currency is valuable, and agree to trade it for goods + services.

I am not aware of anywhere that you can pay taxes with crypto.

Google pushes fake abortion clinic ads to lower-income women, report says

Re: One more reason to shun go ogle and the rest of the alphanuts at all costs.

DuckDuckGo for me.

Google unleashes fightback against ChatGPT, a Bard by any other name

Re: Like running face first into a wall...

I like DuckDuckGo, myself.

It is possible to extract copies of images used to train generative AI models

Re: This is why

You're thinking of the Chaser: https://chaser.com.au/news/

OpenAI offers error-prone AI detector amid fears of a machine-stuffed future

Very emotionally charged

I get the distinct impression that the author of this piece has strong opinions on AIs being used in this way...

CISA sends schools back to the classroom on security

But I bet they'll get no extra funding to do any of those things...

Basecamp details 'obscene' $3.2 million bill that caused it to quit the cloud

Re: "Most of that spend – $759,983 – went on compute"

When the Reg says "most of that spend", I suspect they meant "the biggest chunk of that spend".