Goat Theft Auto
1,052 karma · joined August 17, 2014
Where the state provides some or all of the financial assistance for parental leave, one could argue that it is already funded by all corporations, as it would be derived from tax income.
Firstly to address files being accessed outside of Dropbox - this is true, but literally all it does is read the file attributes: https://i.imgur.com/TADvHp1.png. Moving up the call stack and disassembling the calling function, we can see that it's part of the Python runtime: https://i.imgur.com/1TBong4.png (presumably python27_lockdown.dll is Dropbox's custom hardened copy). A bit later on it does a comparison to ".bat", which identifies it as the function win32_stat() in Modules/posixmodule.c - the ensuing behaviour of this function corresponds to QueryBasicInformation as shown on the original author's Process Monitor dump. Why the Dropbox client calls stat() on files outside of the Dropbox folder (but on the same drive) is not clear, but, as the article above also mentions, that is all it does, so no problem there.
Secondly, the original author also posted evidence of Dropbox accessing various shell folders [2] - Desktop, Documents, Music, Pictures, and so on. This is true but again it's a side effect of an innocent function call, this time SHGetFolderPathW(): https://i.imgur.com/uXN31BI.png. It's actually SHELL32.DLL that is responsible for opening the folder and querying its attributes, not the Dropbox client: https://i.imgur.com/YCyTwNe.png.
Without reversing the entire program we can't say for sure that Dropbox isn't siphoning out data in some other sneakier way, but the accusations of data theft from these file events are simply not true.
Quite interesting to see how it worked, and useful to get the key for the encrypted logs, to see it what it actually did while running. Back then you could intercept the https connections as well as they hadn't pinned the certificates yet, to get an even fuller picture.
There was nothing obviously nefarious going on back then, but that was quite a few years ago of course.
One minor bug report, the mathematical pi symbol (U+1D6D1) used in the unit circle doesn't appear to be displayed correctly (Chrome 40, Windows 7): https://i.imgur.com/zt0HDLO.png. It's okay in Firefox though.
> because I want to be able to just troll through what it is you're doing online, read what I want to read and publish whatever I find interesting
One thing the mass surveillance programme does not do is publish 'interesting' personal data that passes through it. The risk of one's private communications reaching a wider audience than, rarely, the occasional analyst (who is bound by secrecy laws) is close to zero.
The vast majority of people are more at risk of having their laptops stolen, accounts hacked/phished, online presence stalked, and so on by other members of the public rather than the security services. It's much more important to protect against that, than be disproportionately concerned about an invisible omnipresence to which their everyday activities are a trifling insignificance.
But I am openly critical of my government (the UK), both online and offline. I just don't feel there's any significant risk in this, or anything else in my online activities. And that is the reason why I haven't changed any of my online habits.
That is, assuming that they have access to the data, and novel methods of interpreting it in bulk. It'll be like a more honest, raw version of the Twitter archives.
More importantly, his physical security was lacking, as he hadn't properly considered the threat model. If he'd been working in a secured area (like a locked room) where open laptop snatching was infeasible, that would have given him enough warning to close the lid, and maybe pop the battery out. Albeit still vulnerable to a cold boot attack, if law enforcement have such capacity.
In support of project A: fibromyalgia, which has arthritic-type symptoms, is partly linked to anxiety, of which one of the common manifestation is nail-biting. Could evidence of nail-biting be a useful tool as part of differential diagnosis, or a predictor?
In support of project B: the idea of a 'cognitive reserve' in preventing the onset of Alzheimer's disease is fairly well established, even though it has no disease-modifying therapy once the symptoms of decline are already apparent. To what extent can learning a programming language aid that cognitive reserve?
I see your point though, but I'm not sure how well it applies to funding large-scale data collection work like the HGP. Or the LHC, to use an example in another field.
I'd be very surprised if they come anywhere near reaching their goal of a comprehensive whole-brain simulation, but even if the overall project aim falls short, many of the sub-projects are likely to provide worthwhile outcomes.
For example, structural and functional data generation projects described in there (SP1, SP2 and SP3) sound reasonable and reflect the kinds of topics and techniques that are being researched already. The neuroinformatics (SP5) and medical informatics platforms (SP8), while very ambitious, seem like they could be a tremendously useful resource for linking disparate data sets together into a single, more easily-accessible database.
I can see why many neuroscientists are scoffing at the rather over-hyped grand aim of the project, but that doesn't mean the entire thing should be scrapped. Personally I think that funding comparatively open-ended, long-term, risky research is a good thing. Even if it 'fails', that failure is informative in itself in helping to provide scope for future projects. And it increases the opportunity for serendipitous discoveries.
It turned out that the subordinate monkeys were much more susceptible to the temptations of cocaine. In contrast, the dominant ones were able to resist its allure a lot more effectively.
The researchers also looked at the neurobiology of the monkeys. Before being socially housed, they were kept in individual cages for a couple of years. They looked at the main pleasure centre of the brain and measured the level of dopamine receptors (of the D2 type) present there. These receptors are directly stimulated by naturally occurring rewards like social activity, food, sex, and so on - but also stimulant drugs like cocaine.
All the monkeys had pretty much the same D2 receptor level when they were cooped up in single cages, with little variation. But when they were socially housed, the D2 levels of the dominant monkeys rose significantly higher; this too was associated with their lessened vulnerability to cocaine.
So it seemed that social environment can have quite the effect on the neurobiology of one's reward pathway, and potential for drug abuse (as the Rat Park experiment suggested).
On reward pathways - in human stimulant addicts you also see lower D2 receptor levels than in non-addicts [2], although this is lacking a comparative reading from before they were addicted, so we don't know if that's near the state they were in when they started abusing the drug. Having said that, in non-addicts there is a natural variation in D2 receptor levels, and those with less D2 enjoy stimulants a lot more [3], just like the subordinate, lower D2 receptor monkeys.
Unlike Rat Park, however, all the above is based on stimulants, which directly affect the aforementioned receptors. Whereas morphine takes a more indirect route, with different receptor types, so it's not quite comparable. Still, interesting to think about how much we may be slaves to our neurobiology, and our social surroundings.
[1] doi:10.1038/nn798
[2] doi:10.1177/026988119901300406
[3] doi:10.1176/ajp.156.9.1440
Clear explanations, a very pleasant layout, and useful visual metaphors for the trickier parts of the spec. I found it to be both enjoyable and informative.
A really nice example of documentation done well.
I use a smartphone now (which I was able to unlock myself), but when I had a 'feature' phone there were any number of small mobile shops that would unlock for a few quid. This is in the UK.
You have to compare like for like though - looking at the cost to the end user is not relevant, you'd have to look at the cost to the NHS versus the cost to US health insurance companies.
For the NHS, this is publicly available data[1] and we can see that a course of once-daily apiprazole (the drug described in the article) costs the equivalent of $150-300 per patient per month, depending on formulation. Is such data (of actual cost) available for the US?
Also, regarding biomedical research - the British taxpayer funds this as well. Anyway, apiprazole was developed in Japan. It's not all US-centric.
Possibly compromised. That's why it was the subscriber's choice, to decide in the balance of probabilities whether to revoke or not.
It's not like the Debian weak keys flaw where there was absolute proof of the private key being compromised - a database of all the possible keys (at standard lengths) were generated. In that case, StartSSL revoked the certificates automatically and free of charge.
So we can't assume a position for or against revocation charges - it's just not within the scope of the guidelines. Which are non-binding and advisory anyway.
[1] https://cabforum.org/wp-content/uploads/CA-Browser-Forum-Byl...
The guidelines don't state that revocations must be free of charge, where are you getting that from?