JP

Professional computer toucher, unfortunately. Admin of eigenmagic.net. Snarky Antagonist. He/him.

Public Key

npub13evcur9gj746erucqf4xa50ya6nfe8rcxfdmagxyny5hluvqqjjs2ltfw5

NIP-05 Address

daedalus_at_eigenmagic.net@mostr.pub

Profile Code

nprofile1qqsgukvwpj5f02av37vqy6nw68jwaf5un3uryka75rzfj2tl7xqqffgmymz2l

Author Public Key

npub13evcur9gj746erucqf4xa50ya6nfe8rcxfdmagxyny5hluvqqjjs2ltfw5

Show more details

Last Notes

2024-06-21 07:57:04

*cries in NBN*
https://defcon.social/@SomaFMrusty/112653257747284466

2024-06-19 23:02:41

‘You cannot do mass surveillance privately, full stop’: Signal boss hits out at government encryption-busting moves.
A ‘legitimate grievance’ with big tech firms is being used by police as a pretext to undermine privacy, Meredith Whittaker says.
https://www.theguardian.com/technology/article/2024/jun/20/meredith-walker-signal-boss-government-encryption-laws

2024-06-17 05:30:15

- reply

Does that mean Medibank was paying an average salary of $77k pa for its cyber staff, assuming a budget of zero for tools, training, etc.? Because… yikes.

2024-06-17 05:28:34

- reply

I am struggling to reconcile the following two statements on page 8 under the Resources heading:
"Medibank’s core IT security function comprised a team of 13 full-time IT security professionals.
Medibank’s FY22 information technology budget was approximately $4-5 million, of which $1 million was allocated for cyber security."

2024-06-17 05:25:51

- reply

I can see why Medibank were keen to keep the post-incident report a secret. And why large companies should not be given discretion to do so when this sort of thing happens.

2024-06-17 05:24:40

- reply

Like most large incidents, there were multiple opportunities to prevent this happening, or at least minimise the impact. Multiple failures happened to allow it to be this big an incident.

2024-06-17 05:23:30

- reply

Admin creds provided almost unlimited access, no MFA. No MFA on the VPN either. And endpoint protection triggered alerts but no one noticed them or did anything about them. Medibank didn't notice 520 GB of data leaving their systems until after the external incident response team was engaged and one of their analysts figured it out a few days later.

2024-06-17 05:14:57

There are tech details in OAIC's concise statement filing about the Medibank hack. The PDF is here: https://www.oaic.gov.au/__data/assets/pdf_file/0025/221974/AIC-v-Medibank-Private-Limited-concise-statement.pdf

2024-06-14 00:45:00

- reply

"Oh, but the surveillance isn't on by default"
Sure, but it can be turned on, and there are a lot of types of coercive power relationships that will mean it *does* get turned on.
Even if the people being surveilled don't want it to be on.
Even if the people doing the coercing shouldn't be doing that.
Guarding against all those situations is really, really hard.

2024-06-14 00:43:06

- reply

Recall is an implementation of a concept that is inherently dangerous and very difficult to do in ways that don't hurt people.
It is always-on surveillance.

2024-06-14 00:40:53

Microsoft is rethinking Recall, a bit, but still intends to ship it later. Just not right now.
https://blogs.windows.com/windowsexperience/2024/06/07/update-on-the-recall-preview-feature-for-copilot-pcs/

2024-06-13 07:55:25

- reply

Go ahead, Albanese, ya huge nong. Give this insane nosebeans policy a red hot go and see what happens. It'll be hilarious.

2024-06-13 07:53:35

"Anthony Albanese has labelled social media a “scourge” and strengthened his support for a ban on children accessing it, after Peter Dutton vowed a Coalition government would implement a ban for under-16s within 100 days if he wins the next election."
Australia has finally adopted the "drink from the puddle" approach to political discourse.

2024-06-11 22:35:47

venv pip install is just code compiling.
apt upgrade is just code compiling.
We cannot escape waiting for code to compile.
It is relentless.

2024-06-11 20:38:28

Politicians understand what "patterns of data" and "re-identification risk" mean perfectly well when it's their privacy they're concerned about.
https://www.theguardian.com/australia-news/article/2024/jun/12/details-of-25m-in-australian-taxpayer-funded-vip-flights-to-stay-secret

2024-06-11 04:17:26

- reply

"“We need to accept we live in the economy of algorithms,” he said. “The choice is to get on board or be left behind.”
if daylight and person.profession == 'real_estate_agent':
pelt_with_rotten_fruit()
Why 🍅 aren't 🍅 you 🍅 getting 🍅 on 🍅 board 🍅 McKibbin 🍅 ? 🍅

2024-06-11 04:14:28

- reply

"McKibbin didn’t answer how any errors would be caught during a board meeting."
Same way under-quoting of real-estate is detected: it won't be.

2024-06-11 04:12:29

- reply

"McKibbin said that REINSW’s bot has been trained on its information and so will not make an error. Even if it does, he said, Ing is just an adviser and the board is “not bound to follow her advice”."
How long before a board member is forced to resign because they uncritically believed what the bot generated was true?

2024-06-11 04:10:30

Ahahahaha.
"Accurately carrying out this kind of work — sophisticated economic modelling — is not generally understood to be within the capabilities of generative AI chatbots like ChatGPT, on which REINSW’s board adviser bot is based."
https://www.crikey.com.au/2024/06/11/ai-chatbot-real-estate-ethics-reinsw/
I can hardly wait for them to violate the Corporations Act or something with this thing.

2024-06-09 20:53:00

Re Windows Recall "On paper, it's a cool idea." https://www.windowscentral.com/software-apps/windows-11/microsoft-has-lost-trust-with-its-users-windows-recall-is-the-last-straw
No it isn't. It's a terrible idea on paper. "The system will spy on everyone all the time" was a terrible idea that lots of people have already written on paper in the hundreds of history books and dystopian novels that the Recall creators apparently never read or understood.

2024-06-07 20:37:47

I am going to indulge in a #tljr of the judgement in my FOI case, Warren v Chief Executive Officer, Services Australia [2024] FCAFC 73
Mute the hashtag #tljr for a bit if this isn't your thing.

2024-06-07 02:13:55

I am very happy to have won my case, and not have to pay the government's huge costs and maybe lose my house, so I think I will allow myself a bit of a celebration today.

2024-06-06 20:55:59

- reply

A PC with Recall on it is constantly doing data exfil. Data loss prevention tools are rendered pointless. If I can slurp out the Recall database, I have it all at once.

2024-06-06 20:55:43

MS Recall also nullifies the benefit of MFA for accessing other systems. If I can get onto your PC, I can see everything you looked at in your Snowflake, AWS, Google, 365, Confluence, GitHub, Workday, ServiceNOW, and whatever else accounts.

2024-06-05 20:30:13

- reply

Every PC with Recall on it is now an active insider threat.
Recall is constantly taking notes on a criminal conspiracy.

2024-06-05 20:28:47

Oh yeah, just realised something about Microsoft Recall: it will capture a bunch of previously secure data, possibly from years ago.
If someone looks at an email you sent them 2 years ago, it's now in the Recall database.
If someone does a search in Slack, it's now in the Recall database.
If someone does a search in *any kind of search tool* it'll end up in Recall.
Recall doesn't just spy on everyone from now on. It spies on everyone *in the past*.

2024-06-03 19:53:40

Ahahahahaha. I didn't realise the reason people got hold of the internal Google Search API docs is because someone at Google accidentally published them with an Apache license.

2024-06-03 07:02:41

A Bill for an Act to Make School Teachers Put the Date and Time of the Event My Child Needs To Attend At The Top of the Email in a Clear and Readable Block Separate From Their Effusive Blurb and for related purposes

2024-06-02 00:17:45

- reply

@npub1xr8…3q0g they are like a furry hummingbird

2024-06-01 23:37:07

Just saw the tiniest chihuahua walking as fast as its little legs could move to keep up with its owner.

2024-06-01 02:17:42

- reply

The feds are doing the same "use MFA, strong passwords, etc." dance they always do.
Doesn't help us if the businesses hoarding personal info don't, does it?

2024-06-01 02:13:23

"The cybersecurity minister, Clare O’Neil, said late on Friday night the breach was “affecting many Australians” but appeared restricted to the release of names, dates of birth and email addresses.
She said Australians should be especially vigilant for scams."
The scam is called Ticketek.

2024-05-31 21:27:57

We did try to warn you that the people who built robodebt were off doing the same thing in other agencies after slithering away from the mess they made.
https://www.thesaturdaypaper.com.au/news/2024/06/01/exclusive-shorten-revives-the-coalitions-failed-ndis-reforms

2024-05-30 09:35:03

Give every marketer who suggests using Net Promoter Score a massive wedgie and then ask them to rate the experience on a scale from 1 to 10.

2024-05-29 11:07:04

I'm unclear on how the Ticketmaster data breach is worse than the MediSecure data breach but I'm sure Home Affairs will fail to explain it much the same way.

2024-05-26 22:54:47

- reply

Perhaps a department Secretary should have done their actual job rather than playing politics behind the scenes?

2024-05-26 22:53:54

Seems Home Affairs ICT is a big creaky mess and they have no idea how to fix it.
“Over 40 per cent of the 480 distinct business systems have already reached end of life, and the department carries significant risk of failure and increasing costs to sustain its technology environment,” the report said.
https://www.innovationaus.com/home-affairs-tech-at-significant-risk-of-failure/ ($)

2024-05-25 03:30:45

Of course I know where my towel is.

2024-05-24 20:26:59

Google has published a reasonably detailed write up of how and why it deleted UniSuper's cloud: https://cloud.google.com/blog/products/infrastructure/details-of-google-cloud-gcve-incident
tldr: a combination of using a manual workaround for this specific customer environment and default behaviour of tools that was not fully understood by the operator.

2024-05-24 09:09:33

I hope you are embracing the :tgif: comrades. #tgif

2024-05-24 07:49:27

Welp, looks like the #MediSecure database was completely copied. https://www.smh.com.au/technology/medisecure-patient-data-up-for-sale-on-russian-hacking-forum-20240524-p5jggb.html

2024-05-23 20:37:42

- reply

A closed system you are not permitted to understand or change turns you into a mere operator of the system, working within the constraints laid down by the people who own the system.

2024-05-23 20:36:07

The right-to-repair is closely linked with resisting the inherent pressures of capitalism to remove control of the labour process from the people doing the work and place it firmly in the hands of a remote set of managers.

2024-05-21 21:43:19

Idly remembering the time a Microsoft exec chided me for being salty about previous corp behaviour on stuff like the browser wars, Samba, ODF/OOXML, etc. and that it was wrong to be cautious because Microsoft had changed.

2024-05-21 21:13:15

Microsoft Recall is a fractally wrong thing: the closer you look, the wronger it is.

2024-05-21 20:50:01

The fact that Microsoft's new Recall thing won't capture DRM content means the engineers do understand the risk of logging everything.
They just chose to preference the interests of corporates and money over people, deliberately.

2024-05-19 20:18:22

"KPMG, which has been Lendlease's external auditor for more than 66 years, approved the accounts."
"Separate reviews found negative findings in 48 per cent of KPMG's audit cases."
Nothing in this story about any kind of action against KPMG, surprising no one.
https://www.abc.net.au/news/2024-05-20/lendlease-audit-ato-cost-to-whistleblower/103866504

2024-05-19 07:56:02

Was feeling irritable and morose so I went to the gym and now I'm annoyed that it made me feel better.

2024-05-18 07:39:06

Before you delete info from cloud things, change it, edit it, and otherwise mutilate it. Then leave it for a while. Then delete it.
That'll break their backups, like a kind of distributed ransomware attack.

2024-05-16 04:59:27

The ironically named Australian health information company MediSecure has had a data breach.
https://www.medisecure.com.au/
#MediSecure

2024-05-16 00:30:50

There was a cat, so we are now having to provide chicken reassurance.

2024-05-15 06:12:12

Computers should shut the hell up and stay out of sight unless I ask them a specific question.

2024-05-15 00:19:08

Web designers who disable paste for the email and/or credit card fields: #IceMoonPrison

2024-05-13 22:04:47

- reply

I would quite like the ACCC to require that businesses advertising to customers that they can "buy" a thing means you do actually own it, not rent it.

2024-05-13 22:03:22

Oh look, it's people discovering why we were yelling about DRM all those years ago and got ignored and now corporations just delete all the movies and TV you 'bought'.
https://www.theguardian.com/media/article/2024/may/14/my-whole-library-is-wiped-out-what-it-means-to-own-movies-and-tv-in-the-age-of-streaming-services

2024-05-10 23:41:37

"None of us saw digital colonialism coming. Now we must live with its consequences."
Fuck all the way off, my dude. A whole bunch of us did, tried to warn you for years, and were ridiculed and sidelined as our reward.
https://www.theguardian.com/commentisfree/article/2024/may/11/none-of-us-saw-digital-colonialism-coming-now-we-must-live-with-its-consequences

2024-05-09 20:21:23

Dammit, it looks like I'm going to have to actually read Das Kapital to properly grok "what comes after LLMs concentrate ownership of the means of production into 3 multinational companies?"

2024-05-08 22:18:16

wtf Dell?
Close surveillance of people to see if they come into the office or not? Traffic-light ratings?
https://www.theregister.com/2024/05/08/dell_return_office/

2024-05-08 17:14:01

A lament about how Identity and Access Management (IAM) actually works in practice. It's complex and hard! https://matduggan.com/iam-is-the-worst/ #botpost

2024-05-08 05:14:01

https://www.forbes.com/sites/justinwarren/2023/11/08/ai-speculation-dominates-cloud-native-conference/ #botpost

2024-05-01 21:15:02

If only several thousand more people had warned the government about the utterly predictable consequences of building a big honeypot of personal data.
https://eftm.com/2024/05/data-privacy-breach-18-nsw-clubs-sign-in-data-exposed-1-million-people-affected-245356/amp

2024-04-30 22:24:45

The War on the Internet is working as well as the War on Drugs. It is giving us more Internet.

2024-04-30 03:34:34

In a way, putting AI into everything is pretty much an implementation of the "what if we just took the warning labels off everything?" idea.

2024-04-29 22:29:19

Ahahahaa omg people let Facebook automatically buy ads for them and it just took all their money immediately.
Who could have predicted such a thing?
https://www.theverge.com/2024/4/28/24141585/meta-ai-advantage-plus-automated-ad-glitch-cpm

2024-04-26 23:40:30

This blog about passkeys by @npub1rg2…hzyu is correct and that is depressing. Passkeys are a failure that could have been avoided.
https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/

2024-04-22 09:56:56

It seems the entirety of Parliament has decided to put their underpants on their head and run around saying Australian law should apply in other countries.
Why you would want to try to be as big a fuckhead as Elon Musk is beyond me but I guess that's why I'm not an MP.

2024-04-20 02:58:20

Ahahahaha the nazi bar and eSafety are having a stoush. Insert "let them fight" meme here.
https://www.theguardian.com/australia-news/2024/apr/20/elon-musk-and-x-to-fight-australian-esafety-order-remove-content-sydney-stabbing-ntwnfb

2024-04-19 22:13:25

It appears HashiCorp’s explosive claims that OpenTofu had copied Terraform code without permission were misguided. https://pivotnine.com/blog/2024/04/19/opentofu-responds-to-hashicorp-copyright-infringement-claims/ #PivotNine #botpost

2024-04-19 02:17:19

Christ they're still banging on about whether it's okay to dunk on terrible products and the overpaid people who hype them?
Yes. Yes it is okay. It is fine and good. Do it often.

2024-04-13 23:13:48

It troubles me that treating open source software as a common pool resource leads to treating public policy as a common pool resource, and then disappearing up one's own meta-butthole of recursive abstraction.

2024-04-12 21:59:49

- reply

@npub1xr8…3q0g Nothing, as far as I can tell. Here's an example.
https://eigenmagic.net/system/media_attachments/files/112/260/483/090/408/303/original/d3f446228a8d6413.png

2024-04-12 21:53:32

Why do people create 2x2 matrices with one of the axes reversed?
High
|
Low
High - Low
wtf?
Do you often create charts with an inverted X axis?

2024-04-11 20:49:12

I see OpenTofu has responded to HashiCorp's claims that the project infringed its copyright on the "removed" block feature. https://opentofu.org/blog/our-response-to-hashicorps-cease-and-desist/
The drop to Matt Asay may have backfired here, as a whole lot more people now know OpenTofu exists. They're now the underdogs fighting a much larger bully. The history of open source means that open source folks like to be on the side of the underdog. Why would they contribute to Terraform given this other choice?

2024-04-09 20:04:36

I am starting today by attempting to recover my desktop system from a major disk corruption error that means it won't boot.

2024-04-06 11:49:02

Maggie Beer implies the existence of Maggie Wine, Maggie Vodka, and Maggie Gin.

2024-04-02 22:27:32

New Verge article on Brother printers is out! https://www.theverge.com/2024/4/2/24117976/best-printer-2024-home-use-office-use-labels-school-homework
Answer is still "Whatever Brother printer is on sale"

2024-04-02 09:29:24

The government and all the news orgs are just embarrassing themselves with how they're approaching Facebook doing what it was always going to do https://www.theguardian.com/media/2024/apr/02/facebook-shuts-news-tab-after-meta-vows-to-stop-paying-australian-publishers-for-content

2024-04-01 05:58:37

Another super-awesome* thing about the #xz situation is all these people using LLMs to write lots of new, pretty average code, that's opaque to humans, really fast.
We don't need more code, we need less.

2024-03-31 00:08:35

I wrote about corporations paying to maintain open source software last week in issue 86 of The Crux. Given the #xz news, I've made the article public:
It Is Time For OpenFunding https://pivotnine.com/blog/2024/03/31/it-is-time-for-openfunding/

2024-03-20 13:41:03

90% of the press conference was spent talking about AI, yet approximately 0% effort has been made to think through what to do about the downsides and risks. Amazing. #KubeCon

2024-03-19 09:11:15

Some dude is seriously suggesting people should emulate 2002-era AWS in enterprises. #kubecon

2024-03-17 09:29:47

I keep seeing breathless articles from journos about how vital they are with little in the way of supporting evidence. It's mostly special pleading now that Facebook is about to stop giving them free money (an entirely predictable and predicted outcome) and while I kinda agree public interest reporting is good they're not that great at explaining why.

2024-03-14 00:17:36

My MyKi has expired lol. What a shit system this is.

2024-03-13 04:16:33

Project management is about 80% calling/emailing people and asking them if they have done the thing yet when they have clearly not done the thing yet.

2024-03-07 20:38:41

I really enjoy reading a clearly written incident report. I wish the tech industry did more of them.
I also wish there wasn't a need for them to be written as often, but if a worker is killed because of mistakes, writing a good report about it so others can prevent it ever happening again is surely the least we could do?

2024-03-06 02:49:47

AHAHahahahaha. Apparently using AI ethically just requires knowing where your data is, what its sensitivity is, who has access to it, and generally having a fully up-to-date information asset inventory. Simples!

2024-03-02 02:23:00

- reply

@npub1xr8…3q0g who indeed? https://www.eigenmagic.com/2021/02/26/the-digital-platforms-code-a-pyrrhic-victory/

2024-03-01 23:57:11

- reply

I have *receipts* https://www.eigenmagic.com/2021/02/26/the-digital-platforms-code-a-pyrrhic-victory/

2024-03-01 23:55:18

Ahahahaha.Facebook are shutting down their news tab and stopping funding newspapers. Exactly as predicted. https://www.theguardian.com/australia-news/2024/mar/01/facebook-news-tab-shut-down-end-australia-journalism-funding-deals

2024-02-22 21:13:29

Alcion, a security-focused Backup-as-a-Service product for Microsoft 365, has
launched a managed service provider (MSP) partner program in response to
significant demand from MSPs after Alcion’s recent launch. https://pivotnine.com/blog/2024/02/21/alcion-capitalises-on-msp-demand-for-cloud-based-security-and-backups/ #PivotNine #botpost

2024-02-14 10:58:06

Imagine if the ABC, or any Australian TV channel, decided to make a telemovie about #robodebt like they have about the UK #horizon post office scandal.

2024-02-09 05:20:01

I remain convinced that most ball sports would be improved if, under certain circumstances, the ref had to shout MULTIBALL and at least 2 additional balls were sent into play for 5 minutes.

2024-02-08 19:32:01

Handy thing: In Firefox you can now right-click and select "Copy Link Without Site Tracking" and it'll automatically remove all the ?utm stuff from the link URL

2024-02-08 02:57:25

- reply

There is a difference between "this sucks and I shouldn't have to fix it myself" and "this sucks and I am being actively prevented from fixing it myself".

2024-02-08 02:45:38

An important aspect of the hacker ethos is the "got so mad at broken proprietary thing that I fixed it myself" attitude. It runs explicitly counter to the cop mentality half of infosec has these days.

2024-02-06 04:24:47

JFC Coles is putting all its staff and suppliers under surveillance by Palantir.
https://ia.acs.org.au/content/ia/article/2024/coles-inks-deal-with-controversial-big-data-firm-.html
#colesradio

2024-02-02 22:13:10

A Bill for an Act to Make Appliance Vendors Put Their Service Manuals On Their Website for Easy Download and for related purposes