10,161 karma · joined February 21, 2011
Some of the worst and most inaccurate articles I've ever seen have been written by career journalists. (Admittedly I live in the UK where the majority of newspapers are on a par with Infowars for honesty and fact checking. Maybe you live somewhere where professional journalism is more respectable).
Firstly not all security issues involve installing 'malware'. Take heartbleed; a major security vulnerability in open source software. To be hit by that you didn't need to install any non-open source software. You could have had the most pure and open stack of software and hardware ever created and it would have made no difference because the flaw was an information leak that didn't involve installing software or even unintended remote execution of code. That bug was due to the existing already installed open source code copying past the end of a buffer. Similar information leaking bugs could feasibly exist due to CPU bugs or compiler bugs or undefined behaviour in the code etc (i.e. all sorts of ways that don't involve installing malware and aren't even obvious from reading the code).
Secondly, even exploits that do involve "running malware" are very often not because the user intentionally installed malware. They happen because the user did something like download and decode an image file which took advantage of a vulnerability in their (open source!) image decoding library to execute code on their machine. Again in this scenario it doesn't matter that the user would only ever intentionally install open source software, because the malware was executed unintentionally when they performed an activity they didn't expect to lead to code execution (viewing an image).
E: These CPU issues are fundamentally timing attacks that leak information. I don't need to execute code on your computer at all to run a timing attack against you that leaks valuable information - I can do it by sending packets of pure data and don't need to be able to execute arbitrary code on your machine at all. Side channels like timing attacks don't necessarily require any kind of code execution on the target machine (although obviously having a high precision local timer makes it easier). This isn't just theoretical, it has been demonstrated in reality. For example see this paper[1] which demonstrates doing timing attacks against a browser to reveal the users browser history without the need to execute javascript at all. It's all done by sending CSS, which isn't code.
[1] https://www.nds.rub.de/media/nds/veroeffentlichungen/2014/07...
The cache attacks never received as much publicity for some reason (the papers being harder to read may be one). I do wonder what would have happened if this hadn't come out at the same time as meltdown. It's quite possible it would have been brushed under the carpet yet again.
There were token 'fixes' to these things (coarsening timers) in the past, but they never worked and everybody involved knew they wouldn't work. The introduction of features like SharedArrayBuffer revealed how (un)seriously they really took the problem. They knew it could be used to implement high precision timers but it got added to browsers anyway because it was central to the project of making the web an application platform.
They perceive a need to allow high precision timers (or features that can be used to implement them) because without that the web won't be able to do a lot of things that are possible in native applications.
I'd like to think that this is the moment that browser vendors come back to their senses and rethink what they are doing but I doubt it. Google is a multi billion dollar company based on the web as a platform, and running untrusted javascript on other peoples computers. Dropping the idea of the web as the platform to end all platforms would be an existential crisis for Mozilla. They are locked into this madness with no way to stop that wouldn't effectively be corporate suicide. Expect years of half hearted 'fixes' which don't fix the problem.
[1] https://news.ycombinator.com/item?id=10455735
[2] https://www.nds.rub.de/media/nds/veroeffentlichungen/2014/07...
[3] https://contextis.com/resources/white-papers/pixel-perfect-t...
[4] https://www.mozilla.org/en-US/security/advisories/mfsa2013-5... and https://bugzilla.mozilla.org/show_bug.cgi?id=711043
>The idea behind the TTT measurement, as shown in Figure 4.4, is quite simple. Instead of measuring how long a memory reference takes with the timer (which is no longer possible), we count how long it takes for the timer to tick after the memory reference takes place. More precisely, we first wait for performance.now() to tick, we then execute the memory reference, and then count by executing performance.now() in a loop until it ticks. If memory reference is a fast cache access, we have time to count more until the next tick in comparison to a memory reference that needs to be satisfied through main memory.
>TTT performs well in situations where performance.now() does not have jitter and ticks at regular intervals such as in Firefox. We, however, believe that TTT can also be used in performance.now() with jitter as long as it does not drift, but it will require a higher number of measurements to combat jitter.
So, what stops this method from working, even with 20µs resolution performance.now()?
When was this?
> Even die hard apple fans don't use their built in apps for calendar, music, mail, or really anything, because the design is so bloated
That has been the case for as long as Apple has made calendar, music and email apps. People have complained about Mail since the first version (it used to be that most "die hard apple fans" were using Entourage). I hardly need to mention how unpopular iTunes has always been.
The Jobs revisionism every time an Apple product has a bug is extremely tiresome. The famously hated 'skeuomorphic' version of iCal was apparently a specific request from Jobs[1]. The single worst GUI control I've ever had the displeasure to use was the old 'thumbwheel' volume control in Quicktime Player. On the hardware side look at the puck mouse. Those kinds of things were worse than mere bugs in my opinion because they were deliberate and reflected the design philosophy of company at the time (or the inability of anybody working there to tell Jobs to fuck off and stop sabotaging products), and lasted for years before they were replaced.
[1] https://www.cultofmac.com/189707/steve-jobs-himself-is-respo...
Quite a few of the people involved already have a 'platform' writing for major national or international publications[1], or regularly featuring on TV. So yes it does give them something else to moan about in their regular newspaper column, but I'm not sure it makes all that much difference to how much attention they get. The media is already pretty much saturated with people like Germain Greer, and they are all very adept at generating controversy to promote themselves without outside help - that's how they got where they are today.
That's the irony of this really - it's a bunch of people with the biggest megaphone imaginable complaining that they have been silenced because people didn't want to come to/host their utterly insignificant student debate. The fact that such an insignificant thing has become a major story is evidence of just how loud their voices are, sadly.
[1] there are other people being 'no platformed' as well, but I'm not sure the government/Daily Mail is really suggesting they want to force universities to host Abu Hamza al-Masri or face fines
Why is my physical location relevant to criticising death squads executing people in the street?
I'm not from the US and I'm a vocal critic of US governments, past and present. But even if I was American, the actions of the US government wouldn't be something it was within my power to change and wouldn't be relevant to what Duterte is doing.
Adopting the rhetoric of the Stalinist USSR isn't helping your case here: https://en.wikipedia.org/wiki/And_you_are_lynching_Negroes
https://www.theguardian.com/world/2016/sep/30/rodrigo-dutert...
>Rodrigo Duterte vows to kill 3 million drug addicts and likens himself to Hitler
No more stupid than 60m people in Germany or 40m people in Italy or 10m people in Chile or 4m people in Haiti or 30m people in the Philippines or 7m people in Zimbabwe or 20m people in Venezuela etc.
It doesn't require a 'stupid' population to believe the propaganda of murderous regimes; it's something any group of people is susceptible to, as we have seen time and again at great cost.
From the article:
> Amazon has responded, and its response points to the unfair nature of Google effectively blocking access to the YouTube web site based on the type of device being used to access it. "Echo Show and Fire TV now display a standard web view of YouTube.com and point customers directly to YouTube's existing website," Amazon's statement reads. "Google is setting a disappointing precedent by selectively blocking customer access to an open website. We hope to resolve this with Google as soon as possible."
I do think the police should act to try and prevent violent groups from committing violence. Your position seems to be that the state should accept violence as long as the people committing it claim to be political? If anything organised political violence is the type of violence that it's the most important to prevent because it has by far the largest potential for harm.
I can talk about specific things the UK police have done when targeting 'extremist' groups and how I disprove of them if you want (undercover police assuming fake identities to the extent of having children with women in the targeted groups being one). But disapproving of specific things isn't the same as saying the police shouldn't be investigating and infiltrating organisations advocating violent ideologies.
I think the biggest problem is that it only works when the other side is willing to play by the rules of the game. If the opposition is willing to blatantly lie even in the face of direct evidence then the normal rules of debate just break down. (I know all politicians lie, but Trump's disregard for political norms is completely different from what you got from candidates like McCain, Obama, Romney or Bush).
Similarly from a UK perspective giving disproportionate coverage to UKIP and Farage just increased their popularity.
I would hope that describes virtually every post war western government.
And many of them have implemented various levels of 'authoritarian' systems to prevent the (re)rise of Nazis. Ranging from the banning of books in Germany to more mundane things like the British police spending a lot of time and money infiltrating neo-nazi groups and banning them. In the latter case exactly the kind of thing you are worried about happened - the powers granted to the police were also used to target other non-nazi groups like environmental protestors. Despite being very critical of police tactics in the latter cases, I still have no problem with the police targeting Nazis.
Anyway, western governments don't need to raise the spectre of Nazis to gain support for increased police and surveillance powers. They have plenty of more recent things to talk about (from Irish terrorists to ETA to Islamic terrorists). This comment thread is evidence enough for that - there wouldn't have been nearly the same emotional reaction to somebody talking about bombing ISIS.
What I'm talking about is more things like the Sun (Murdoch tabloid in the UK) printing front pages about how Google helps terrorists build bombs.
The reason I mention right wing politics is firstly that they are the ones in power at the moment in the US/UK/Australia - Trump and May aren't going to care what the Guardian or NYT say and don't have any ideological reason to care about things like the immorality of online advertising or the affect of social media on mental health. Secondly, in the UK at least, the press as a whole is much more closely aligned to the conservative political parties. The UK press is divided roughly into right wing (Sun, Mail, Express, Telegraph, Times, Spectator), liberal (Guardian, New Statesman, FT, Economist) and left wing (Mirror, at times). The right wing outlets have vastly higher readership and reach. So if the media does have an influence on politics, it's going to be in one direction.
But my point really was that it's interesting to me to see how much the papers are working for the right wing parties or how much the right wing parties are following the agenda set by the newspapers. That's probably not so much a thing in the US (although the same question about Fox might be), but it is in the UK, especially at the moment.
E: also, to be clear, the same financial inceptives apply to the NYT and Guardian - online advertising is killing their revenue streams as well. It's just that as I said they have limited power at the moment (and it's arguable how much power they ever have - neither seems to have the ability to set the news agenda outside of the liberal middle class bubble, unlike the UK tabloids for example).
https://www.theguardian.com/media/2017/nov/16/rupert-murdoch...
>Rupert Murdoch say News Corp is not looking to expand its newspaper empire, conceding digital advertising “has been tremendously damaging to print” and some of his papers were struggling.
Over the next few years it will be interesting to see how successful the right wing anglosphere press is at getting governments to regulate Google. It's been building for a while now and not just from the Murdoch press. The Daily Mail in the UK has been campaigning against Google for a number of years now.
The events of the past few weeks should serve as a reminder that what's historically been considered 'normal' behaviour in a workplace just because people have gotten away with it doesn't mean it's morally, ethically or legally justifiable.
Weirdly it seems to be the loudest advocates of TDD who are the most confused about this.
I have to admit that I've never had the guts to directly intercede in a situation like that, although fortunately I've not seen many where I'd have considered it (more down to my lack of social life than these things being rare). It can be very difficult, especially if you are a young man without much relationship experience. It feels presumptuous and rude to intervene in other people's lives when you aren't sure how bad the situation is and what their relationship is. As I mentioned in another comment society is so so bad at giving people any kind of framework about how to begin relationships. If there are other people around who are also not intervening then that tends to reinforce the idea that it must be normal, acceptable behaviour. Even when it isn't. Older men have an important role in setting an example here.
As you say, there are ways to try and help without direct confrontation. Get between the man and the woman to give her a chance to walk away. If you think something really bad is possible then stay in the room and don't leave them alone.
I read an article by a woman a while ago talking about how older men in her life had subtly intervened in these kinds of situations to help her out, and how she hadn't realised at first. I wish I could find it now.
Firstly I've not seen any #metoo stories that were about guys just coming up and saying hello. If that was the extent of the problem we'd be in a much better place.
But you're right in the sense that constantly having strange guys come up to you and introduce themselves, even politely, is something some do women complain about, because it can be incredibly annoying and emotionally draining to have to deal with that all the time whenever you are in public. Being forced to constantly reject people isn't nice. Also, even if the guy is polite and respectful, the woman won't know that until he has left, so the sight of a man approaching you just to say hello is probably going to come with some kind of defensive emotional reaction, because he might be one of the real assholes.
To be honest personally it's something I find a bit creepy. I'd never do it myself. There are times when it can feel natural to strike up a conversation with a stranger (some kind of shared event or experience or whatever), but very rarely does it seem natural to me to just go up to complete strangers and introduce yourself, outside of the context of events very specifically designed for that. I'd find it pretty strange if a woman did it to me, no matter how attractive she was.
>Another aspect I do not see mentioned in these discussions is "it's the guys who must be proactive" attitude which is common even among women. So some guys may feel like they must do something, alas, not always sure what and how to do it properly.
This is part of what feminists mean when they talk about patriarchy; the expectation on men and women to conform to certain roles in sexual relationships is part of that. Patriarchy is bad for men as well! It is a problem that some guys feel obliged to be the proactive one, and a problem that a lot of dating "advice" for men is pretty much summarised as 'be more aggressive' rather than 'be more thoughtful'. There's a lot to be said on this topic about how we as society educate young men about what the beginnings of relationships look like and how we need to do so much better.
>The best way to go would probably be make sure that guys understand once and for all that "no" means "no" and women to be encouraged to show their displeasure at once without being afraid that they will be judged for that.
It shouldn't be the responsibility of women to have to say no to stop already in progress actions by men. Some situations obviously would be prevented/de-escalated by men knowing no means no. But that still leaves a lot of other situations. Events where women feel social or career pressure towards not saying no. Events where women were too drunk to say no (as in the article we're talking about). There's a whole lot of emotional complexity to a lot of these situations that can make it difficult to explicitly say no. Especially for young women/teens who are less experienced. One of the notable things about the stories posted by women this week is how young so many women were when they were first assaulted or raped, and how confused and guilty they felt about it. The emotional complexity of relationships is challenging for most adults, never mind children. That emotional burden can't be allowed to fall entirely on one party in specific instances or one gender in general.
As the man, without knowing how she feels, why would you take the chance of destroying any chance of a relationship by gambling on what her reaction to your aggressive advances will be?
I know there are grey areas here. Women know that too. In the vast majority of cases they aren't out to get you. A lot of women could tell you stories about guys who perhaps unknowingly crossed the line and how they still know and get on with those men and don't hate them. Women want to feel safe going about their day to day lives. Give them the opportunity to back out of situations. Make it clear that it's ok for them to say no. Apologise straight away when you fuck up.
As members of a community/industry we have a collective responsibility for what goes on; for our own behaviour, for the behaviour we let men get away with, and for supporting victims.