@dr_analog's banner p

dr_analog

top 1% of underdog fetishists

4 followers   follows 1 user  
joined 2022 September 05 14:10:31 UTC
Verified Email

				

User ID: 583

dr_analog

top 1% of underdog fetishists

4 followers   follows 1 user   joined 2022 September 05 14:10:31 UTC

					

No bio...


					

User ID: 583

Verified Email

I'm currently working as a cybersecurity engineer and I'm a former Google SRE. So, I request you do not kneejerk dismiss me as some kind of technical ignoramus if you think that's what my argument hinges on.

Whenever privacy warriors complain about privacy I find myself rolling my eyes and thinking okay boomer. Even though more people than boomers say this and I do believe privacy is important. To be clear I mean privacy in the abstract. "I don't use Facebook because [privacy]". "I am looking to adopt a GrapheneOS based phone with no Google apps because [privacy]".

Privacy is obviously important. I don't want some rando, or worse, some personal enemy to rifle through my all of my digital data looking for ways to harm me. But the abstract privacy concern takes the form of a Motte and Bailey between the two. Google, Facebook and friends mostly act on your private data in the aggregate, but the privacy advocates generate worry that your intimate conversations or pictures are being personally viewed.

I also find privacy warrior claims rather, lets say, Joker-level anarchistic about rule of law. Everyone should have end-to-end encrypted messaging and the government should be locked out of private spaces no matter what. In no other domain do we accept a claim like "this dungeon in my house is off limits even to detectives with a court order because it is my private property" but apparently yes this digital cache of self-produced child pornography or evidence of a ticking time bomb terrorist plot[1] is something we can take to our graves regardless of any legitimate pursuit of justice. The level of hostility towards government here surpasses any of government's responsibility to protect its citizenry.

I'm not arguing against having digital security. It's very important for both organizations and individuals to have basic opsec lined up, especially because of how many automated and directed attacks there are trying to steal money and secrets. But in this battle companies like Google, who privacy advocates possibly fear only less than Facebook, are far closer to friend than foe because they provide a level of sophisticated and free security and direct privacy guarantee that almost nobody can achieve on their own.

The level of fear and worry privacy warriors generate rises to the level of conspiracy-adjacence. The word "qanon" pops into my head. Someone, Out There, is collecting all of your private information and you need to disconnect from the grid right now. Abandon all petty conveniences like being able to share photos with grandma, your life depends on it.

Ironically, the self-hosted Trust No One approach appears to make people even more vulnerable to attack. Even very technically sophisticated friends of mine who have hosted their own email have been hacked and their identities stolen (and used against them for extortion) in ways that would not have happened if they had stuck to GMail and used their FIDO2 two factor key for second factor.

I have another friend who decided to take his family's photos and files out of iCloud and Google Drive. He set up a home RAID array and was cruising along fine but neglected to monitor the drives. One failed and he didn't know, so when the second failed all of his data was gone. He didn't have backups, because why would you if you have RAID and snapshotting. He's not some noob either. He is also a sophisticated technology professional.

My argument against individual actions you can take on privacy are something like: you can do a few basic things to radically improve your personal opsec, and anything else is rapidly diminishing returns at increasingly greater inconvenience and, worse, may be a net increase in your vulnerability to attack or data loss.

My argument against regulatory action on this is, well: Europe leads the way on this. Does anyone think, say, GDPR has made Europeans much safer than Americans? At what regulatory and compliance cost? Mostly GDPR seems like a joke.

The fact that privacy fretting appears to primarily afflict men (with notable exceptions like Naomi Brockwell) suggests that there must be something autistic about it.

(Mostly, I can't shake the strange feeling that inside of all of this is a The Last Psychiatrist style phenomena (made with impeccable erudition that I could never live up to) that privacy worries are a proxy for dealing with some... thing(?) that people would never allow themselves to acknowledge consciously)

In the end, excessively fretting about privacy mostly is costly (in time), increases inconvenience and annoyance, increases the nanny/regulatory state, puts you at greater risk, and just makes the ads being served to you dumber.

  1. I'm aware this argument is cited derisively by other security professionals, but that doesn't make them correct. Ticking time bomb plots are a real thing.

The theme is marking the occasion of the SOTU by taking inventory of some of the broken promises, incompetence, lies and hypocrisy in just six weeks.

PLEASE try lowering the temperature, Dems.

I agree, but let us also remember to pin some blame on Trump for doing the ICE raids as flamboyantly as possible.

Obama deported 410,000 people in 2012 and managed to avoid cameras far better.

I am convinced Trump wants liberals to overreact because it's the best campaign ad and the mobs are happy to take the bait.

Why can't the production studio be looking at the demographics of the customer base and decide that hey some %age of our customers are black, and so they may relate to the story better and spend money on it if we include more/any black characters?

I've barely read LOTR but unless whiteness was a critical part of the story it seems fine to change skin color. It's a movie about, like, whole different species of humanoids right? Different skin colors should be well within bounds?

I agree a lot of productions feel like they're bending over backwards to include more races and it comes off as cheap and woke fearing (see: children's books), but the more basic business case seems valid too.

EDIT: I've not seen the show nor have I read the books and I mostly watched the original movies with 'drinking game' style interest, so pardon my ignorance. I see from the responses that the sprinkling of racial diversity is done in a clearly cheap and ham-fisted way. Thank you to everyone who took my question seriously.

I have a lot of sympathy (or maybe pity) for SBF. "Stole client funds" appears to have solidified as a meme much the same way "crossed state lines" had in the Rittenhouse case.

I think it's hard for people, including technologists who haven't worked as quants, to appreciate the level of technology risk that's present in quant trading. In most of tech your biggest risk is having all of your data destroyed, and you can address that with well worn improvements in backups. You also risk being hacked but those breaches tend to be embarrassing rather than company ending. Even Sony, which was pwned as hard as you could possibly be pwned, ultimately recovered. But an additional risk in quant trading is accidentally and irrecoverably giving all of your assets away in a few seconds.

Even companies that are following all of the rules and have the right number of members of the professional management class in their ranks can destroy themselves in a matter of minutes. Knight Capital Group destroyed itself in 30 minutes by (with some creative license) failing to follow heroic practices around retiring old flags in protobufs.

Alameda/FTX had a culture that resembled "move fast and break things". They grew extremely quickly. I'm highly skeptical they were able to stand up robust accounting and practices to mitigate technology risks in so short a time.

When SBF says he didn't realize they were leveraged due to accounting error, I believe him. It's not like you can just install the QuickBooks Enterprise Crypto Derivatives Exchange plugin. All of this stuff was bespoke, and in a hurry.

When you thought you had $30b in assets and minimal liabilities, you can spend a billion or two on indulgences, charitable giving and campaign contributions. Your can say confidently you're not investing client funds. If those assets are suddenly marked down 90% you look like a fraud and you're in deep shit.

That's the nature of the business and he knew the risks. But probably in hindsight I'm sure he wishes he had been even more careful.

This isn't to say that I believe he definitely didn't commit fraud. Rather this is me saying that as someone who has pushed code that I thought accidentally gave away $10 million of my employer's money (the gigantic exhale of relief came when we learned I failed to scale by 1000x in the reporting and not the ordering), I am defaulting to blaming it on stupidity before malice.

There's a huge gulf between that and what Trump is doing currently. Trump is making these raids as much a spectacle as possible.

Did we forget the Studio Ghibli rendition of the crying handcuffed deportee tweeted by the White House? What about videos captioned "ASMR: Illegal Alien Deportation Flight"?

He even has fucking Dr Phil accompanying raids now.

I love the insinuation that intel agencies are behind the leak of his sex vids. Are you so fucking edgy a journalist that Mossad used 0-day cyber arms to hack sex vids out of your possession somehow to embarrass you? Jokes on them, I have nothing to be embarrassed about, because my sex vids are 🔥🔥🔥

Please don't watch though, this is a violation of my privacy. My private hot gay sex, that is. Because I bring the truth so hard.

On MAD, some is more MA than others

One detail about the doctrine of Mutually Assured Destruction (MAD) that I was not really aware of until now is the relative asymmetry of it.

In a nuclear exchange, MAD deterrence depends on both sides being able and wiling to destroy the other if they detect a first strike.

In the case of NATO vs Russia, MAD is not even! If Russia decides to first strike NATO, it's possible they could wipe out Europe before it has time to respond, in perhaps 10 minutes. But the US part of NATO is another story, and could take up to 30 minutes to wipe out. That's considerably more time for the US to order and launch a counterstrike that wipes out Russia.

The inverse does not hold, however. NATO can launch a first strike on Russia that ends them entirely in 10 minutes, cutting off options to respond. To be clear here some response would happen, like a few cities within the NATO bloc get nuked, but it's quite probable Russia could be wiped out entirely with only a minor amount of apocalyptic damage done to NATO.

What further alarms Russia is that this 10 minute window drops considerably if Ukraine is added to NATO. A decapitation strike against major cities in Russia launched from Ukraine could take as little as 5 minutes. That's not even enough time to notice, get positive confirmation and wake people up: Russian leadership would just sleep through Armageddon.

If you take Russia at face value, and that they invaded Ukraine because it would not commit to neutrality, it would seem to be a strategic blunder on the side of the US to not consider this more seriously. The logic of launching a first strike against Russia seems crazy to us, but that's almost certainly playing half-court basketball. If you think like a Russian, people who have endured centuries of extremely cruel militaristic and fuck-you-got-mine rule, a cold blooded NATO first strike that sacrificed a mere tens of millions in deaths in Europe might be a real fear. Especially if Russia senses its own competence wrt nuclear war is weakening. Also it's not like the US is not capable of unspeakable hypocrisy and cruelty when it comes to geopolitics. Regime change is a thing we've gleefully engaged in.

Anyway, learning about this asymmetry in nuclear MAD makes me more sympathetic to Russia's POV. The war with Ukraine was not inevitable and the possibility of allying Ukraine with NATO has, in hindsight, high cost with relatively little upside?

Am I misreading anything with the MAD situation? I understand there exist planes and subs that can deliver nuclear warheads but I don't see Russia's force projection capabilities being able to fulfill the retaliatory threat. For example, I understand it's somewhat an open secret that Russia's subs are confined to near-Russia and the US actively tracks them and can pre-emptively obliterate them the moment things get hot.

Carrying a big stick sounds important for global stability, but probably also avoiding scaring the shit out of failing and desperate nuclear armed powers is key.

I'm going to be contrarian and say I thought Biden's debate performance was horrifying but I think it's still fine to run him if voters were like me and not like normal people.

I realize he looks terrible but is the President not being in peak fitness actually that important? Biden doesn't strike me as insane, or malevolent, or like he's so completely out of it that he'll launch nukes because he mistook the big red button for the toilet handle.

I'm probably too cynical but I think the President's job is probably a lot like a doctor's job in a hospital: the nurses all know more or less what the patient needs but they need the MD to make decisions. Sure you'd like a brilliant doctor like House for the truly difficult problems but any doctor that just did what the nurses told him to would probably make for an okay hospital. Biden probably spends his days picking from a set of reasonable proposals offered by his handlers. If he makes too many batshit decisions in a row too often he'll eventually get replaced.

I also don't think Trump has any edge on the mental side that would make up for the fact that he's him. Also his edge isn't great anyway, he's also incoherent, except he presents with speed freak energy. I wouldn't expect his judgment to be any better and he could just as likely start sundowning any day now as well.

It'd be sweet if they ran a Biden that was 20 years younger, but I still think he's better than Trump.

This is the "birthright citizenship" case: does the Court agree with the Trump administration that some people born on U.S. soil are nevertheless not American citizens? IDK! Because the Court doesn't answer that question.

I'm honestly a bit frightened by this one. I don't find most of Trump's stuff all that worrisome but this seems potentially pretty society altering.

My parents were illegal immigrants. They had me here in the late 70s so I had citizenship by birth. My parents have since received amnesty and even applied for citizenship and received it as well. But I think if the EO holds I don't see why they could not apply this retroactively. If it makes sense to do it for the future it makes sense to do it for the past too.

My parents would have more standing to stay in the US than I would.

Would be kind of funny to have to pack up and start a new life in the old country though in middle age.

I don't follow. You believe Congress isn't allowed to decide violations of law are no longer violations of the law?

IMO it sounds like you only like law when it supports your POV.

EDIT: I also find the nExT admiNiStrAtIoN / white genocide argument a bit funny because it was Reagan that granted my extended family amnesty and they're all white and hardcore Trump voters.

Having to suspend or scrap tons of ongoing research projects is fairly bad for them, and probably also society. I suppose they can float them out of endowments but not permanently.

It would be nice if we were laying off biochem grads for good reasons and not ideological shit test reasons.

I do wish I was, and my impression is that most of you would be happy to have me.

Yes.

Are you single? Have you considered a sham marriage to an American woman (or man)? I've seen that work fairly well.

I view this lawfare as both morally wrong and deeply destabilizing.

Why is this lawfare? And why is it wrong? I can see both sides of the issue but want to make sure I'm not missing something.

Camp: this is terrible

This is a tragedy for justice. Trump did stuff that, sure it was technically illegal, but it took prosecutors like 5 years to charge him for this. The fact that it took so long is sus. The fact that it's during an election year is sus. Also, there are tons of people committing actual horrific felonies in NY that aren't being prosecuted. Additionally, it really seems like the prosecutor had to squint to find something to bust him with. This seems very politically motivated and like it sets a terrible precedent. It simply shows that you can prosecute any business leader for something if they infuriate the establishment enough. Additionally, you can't really read too much into this. He was charged and convicted in NY, a place that's full-on Trump Derangement Syndrome. He probably would've been sentenced to death for a parking ticket if the court allowed it. America is in danger.

for contrast

Camp: this is fine

This is a victory for justice. Even former Presidents are not above the law. He did a crime and he was convicted of it. He very much had a guilty mind, surrounding generally bad behavior, and did bad things while campaigning to be a leader of the country, one of the most important positions in the world. In the process of these morally bad acts he crossed a legal line and he's being called to account for it. Sure, it took a long time and sure it might have some twinge of political motivation to the timing, and this is a crime few people can really relate to, but you also want leaders held to a high standard and you also want them to be accountable. Juries may hate Trump but it's just implausible to expect even 12 New Yorkers to find him guilty of something just because they hate him. America has demonstrated its commitment to rule of law and we should celebrate.

Not all privacy desires have their foundations in criminality and kiddy porn. Villainizing E2E encryption and truly private spaces as exclusively the domains of ne'er do wells is the exact same tactic people use against guns to win the culture war. Carrying a pistol doesn't make you a paranoid asshole; it means you're vastly more prepared for a rare occurrence than someone who doesn't.

Just to be clear, as I mentioned elsewhere, I'm not villainizing people for using E2E encryption. Just pointing out that E2E encryption is an absolute gift to villains while everyone else using it LARPs as an enemy of the state.

As someone who has guns himself, my view is

  1. it would be best if society had no guns in it
  2. but our society has guns
  3. criminals exist and are incentivized to crime
  4. police cannot stop them from doing crime fast enough
  5. therefore, I should have guns myself

Perhaps if police response time in my town was 90 seconds and not 20 minutes the economics of crime would change, but it's not so I need a gun.

Anyway, I agree given the circumstances handgun ownership makes sense. Is the claim for E2E messaging even this solid?

I want to be able to talk about the government without them listening. I want to be able to talk about psychotic leftists without them getting me fired, and I want to watch exotic pornography without pyschotic rightists getting me fired. I don't trust any convenient megacorp to safeguard me from any of these actors or themselves.

I don't quite follow. You want to be able to do this stuff under your real name without every adversary finding you? Or... you want to be able to do this via an anon handle without being easy to doxx?

If anything, working at Google actually made me a lot more confident about their PII protections. They take it extremely seriously and I'm actually surprised so many people were able to abuse it, though it's to be expected at their scale: Google has 175,000 employees and maintains billions of accounts.

To me, this is the exception that proves the rule: you're safer with Google.

I brought up the wholesale surveillance concern here https://www.themotte.org/post/851/culture-war-roundup-for-the-week/183482?context=8#context

It's not a complete response to your comment though.

The number of people that government spy agencies can harass is much more scalable. The Canadian truckers had their bank accounts frozen less than 2 years ago! We need digital privacy so that a government bureaucrat can't change a 1 to a 0 and lock a million dissidents from their bank accounts.

Scalable harassment is worrying, though I don't see how this is a function of privacy really? Like how would you solve the de-banking problem? Is the problem that it was too easy for the government to figure out who all of the protestors were and then work backwards to find their financial accounts and lock them down?

On the other hand, let's say I had cryptocurrency on my computer. (I don't, by the way). I would take extreme measures to keep this secure because everyone in the whole world could potentially steal my coins.

Irony of ironies, the extremely technically competent anarchist friend who had his self-hosted personal email hacked was because the attacker was an organized criminal who knew he had millions of dollars worth of cryptocurrency. The level of sophistication deployed by the attacker was astounding, which included producing faked search warrants. The attacker also already somehow had copies of his driver's license and we have no idea how he got it. They were not successful in stealing his Bitcoin but they came very close and this criminal continues to pop up in his life from time to time using information he gathered.

See also that a Bitcoin core developer was hacked recently https://www.theblock.co/post/198688/bitcoin-developer-pgp-exploit

In the non digital world there are a lot more checks and balances. Getting a warrant to search a home is one thing, mass surveillance on millions of users is another. What is happening online is more like the police obtaining a search warrant for every building in a city and sending a robot with drug sniffing capacity into every room in the city. The police may follow a specific suspect around, while the state in many countries forces ISPs to keep a record of all visited websites for millions of people. Governments want to snoop mass amounts of data on cloud servers but don't have the right to routinely search hotel rooms or offices spaces. Why should data on the cloud be less protected than a letter laying on a desk in a hotel? Why can't digital services be as private as a taxi service? If I rent an uber the police can't set up a roadblock and search all documents in every car. So why can they do that for email?

In the olden days we used to argue that mass surveillance was actually useless because it generated far too much data and even detection systems with very low false positive rates still created an unworkably huge number of events that had to be manually reviewed.

I haven't seen anything that has changed the story on this, except in CSAM which is so radioactive that law enforcers have successfully pushed the burden onto companies to surveil and report them. There's been some criticism of the false positives here https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html but so far this doesn't seem like a huge problem. And again only something like CSAM appears to rise to this standard, for now.

To be clear, I still think police should have warrants to do stuff.

As for GDPR it did make a big difference. In my career as a developer I hear the acronym GDPR on a regular basis, and it has forced companies to be far more careful in how they store and handle data. GDPR put a lot of pressure on companies to think before they acted and made the non-tech portion of companies much more interested in data security. Thanks to GDPR I have had non tech boomers with a business background send long emails asking about how we encrypt data, TLS, when data is deleted and other issues that they never thought about 10 years ago.

I thought the Snowden leaks, specifically the revelation that the NSA was able to re-construct GMail inboxes without a warrant because they had tapped replication events on private lines between Google's datacenters, compelled an industry-wide effort to take security a lot more seriously, including TLS everywhere by default. Also it timed well with the fact that CPUs were now fast enough that encrypting by default didn't add an unacceptable burden. I'd be curious to see how the GDPR specifically made a difference here since it coincided with these two other events.

But no, you're illegitimate. I'd be willing to fast-track you through the immigration system, but you'd have to go back first

I appreciate the endorsement.

Oh, I was born to two citizen parents. Citizenship is mine by blood.

Well! My blood claim is probably as solid as yours is, maybe even moreso.

You're just a citizen and I am not in your framework by legal technicality.

who cares what Vietnam's and Cambodia's tariffs on the US are? those places are poor AF!

why is that how you decide to set your tariffs? we just going by vibes here?

I'm always amused by this argument because my parents, who became legal via the 1986 amnesty, have voted red down the line in every election

my father still insists Nixon was the best president in history

it's true there were more people in the US fleeing communism during that time, so they would be more inclined to vote Republican

what about today? Venezuelan immigrants are in the news, guessing the ones who ever feel inclined to vote won't be so impressed by the way Democrats sound

This is implicitly misrepresenting the actual situation. Searching your home dungeon takes a warrant; searching your digital asserts (held by third parties) for self-produced child-pornography or other state-disapproved things requires a subpoena at best and may simply be blanket done on everything by some sort of automated system.

Oh, sorry, I meant to say end-to-end encrypted messaging up there. Fixed. That's private to only the sender and recipient and even a warrant can't compel discovery if both sides destroy their copies .

The steelmanned case is "Trump 2024 The Return - Make Liberals Cry Again" (bumper sticker). Obviously Trump is a greedy unprincipled narcissistic hypocrite who hasn't delivered on anything really, but he sure does drive the sanctimonious liberal elites insane in a way that no other Republican can. Plus he's pretty entertaining, at times.

Much more exciting than a generic Republican. I don't know if there are more redeeming qualities than this.